CORScanner

OVERVIEW

CORScanner (github.com/chenjj/CORScanner) is a Python tool purpose-built for one job: sending a batch of crafted Origin headers — including reflected arbitrary origins, null origins, and subdomain/prefix/suffix variations of the real origin — against a URL or list of hosts, then checking whether the response's Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers echo them back.

Built on gevent for concurrency rather than plain threads, it can work through large host lists (-i domains.txt -t 100) fast enough to fit into a recon pipeline, flagging every host whose CORS policy looks permissive so a tester can manually confirm which ones actually leak authenticated data cross-origin.

USE CASES

Practical use cases

• 01

  Batch-testing a list of enumerated subdomains for reflected-origin or null-origin CORS misconfigurations.

• 02

  Confirming whether an API endpoint echoes an arbitrary Origin header alongside Access-Control-Allow-Credentials: true.

• 03

  Checking for weak origin-validation logic (regex bypass via subdomain or suffix tricks) on a single target during manual testing.

• 04

  Feeding a large recon-stage host list through a fast concurrent scan before prioritizing manual CORS review.

QUICK START

Once hosts are enumerated, to batch-check each one's CORS policy for origin-reflection or null-origin misconfigurations worth manual follow-up.

1. Confirm the target host or host list is inside the authorized scope.
2. Install CORScanner’s Python dependencies (pip install -r requirements.txt).
3. Run it against a single URL, or against a file of hosts with a thread count for concurrency.
4. Review the flagged results and manually replay each one with curl or Burp Repeater to confirm the actual response headers.
5. Document which origins were reflected and whether credentials were allowed before reporting it as exploitable.

python3 cors_scan.py -u https://target.example.com -v

BEFORE YOU RUN IT

What to check before running it