Welcome to the GitHub repository for Corser, a powerful command-line tool designed for detecting CORS misconfigurations in web applications. Corser is developed with the goal of providing security professionals and developers with an efficient means to identify and exploit CORS issues.
Install Corser using the following command:
go install -v github.com/cyinnove/corser/cmd/corser@latest
Or you can build it and run using docker :
git clone https://github.com/cyinnove/corser
docker build -t corser .
docker run corser help
- Single URL Scan: Perform a CORS scan on a specified URL.
- Multiple URL Scan: Perform CORS scans on multiple URLs from a specified file.
- Proxy Mode Scan: Receives requests from an upstreaming proxy and scan them, Ex: BurpSuite, ZAP ...
- POC Generation: Generates POC Any bug found in the Single URL scan mode .
Run Corser with the desired commands and options:
corser [command] [flags]
corser help # this for help
completion
Generate the autocompletion script for the specified shell.help
Help about any command.multi
Performs scans on multiple URLs from a specified file.single
Performs a scan on a single specified URL.proxy
Receives requests from an upstreaming proxy and scan them, Ex: BurpSuite, ZAP ...
Flag | Description |
---|---|
-g, --gen-poc |
Generate a PoC for any vulnerable request with the name of the URL and result found. |
-h, --help |
Help for single command. |
-u, --url |
Specifies the URL to scan for CORS misconfigurations. |
Flag | Description |
---|---|
-h, --help |
Help for multi command. |
-l, --list |
Specifies a file path containing URLs to scan, with one URL per line. |
-o, --output |
Specifies the output file path where results should be saved. |
Flag | Description |
---|---|
-h, --help |
Help for proxy command. |
-p, --port |
Specifies the port of the proxy server that will receive requests from burpsuite. |
-O, --origin |
Sets the Origin header value to use in the scan requests. |
-d, --deep-scan |
Enable deep scan for more advanced CORS bypass techniques. |
-v, --verbose |
Enable verbose mode for detailed logs. |
Flag | Default | Description |
---|---|---|
-c, --concurrency |
10 | Determines the concurrency level. |
-k, --cookie |
Defines cookies to include in the scan requests. | |
-d, --deep-scan |
false | Enable deep scan for more advanced CORS bypass techniques. |
-H, --header |
Specifies additional headers to include in the scan requests. | |
-m, --method |
"GET" | Specifies the HTTP method to use when sending requests. |
-O, --origin |
"https://zomasec.io" | Sets the Origin header value to use in the scan requests. |
-t, --timeout |
5 | Sets the timeout (in seconds) for each request. |
-v, --verbose |
false | Enable verbose mode for detailed logs. |
-
Single URL Scan:
corser single -u/--url http://example.com
-
Multiple URL Scan:
corser multi -u/--list url_list.txt -o/--output results.txt
-
Proxy Mode Scan:
corser proxy -p/--port 9090
{
"result": [
{
"url": "http://127.0.0.1:3000/api/v1/user",
"Vulnerable": true,
"payload": "https://vulnserver.zomasec.io",
"details": [
"ACAO Header: *, ACAC Header: true",
"Wildcard ACAO header found. *"
],
"request_data": {
"ACAO": "*",
"ACAC": "true",
"Headers": [
"Authorization",
"X-Requested-With",
],
"Methods": [
"POST",
"GET",
"OPTIONS",
"DELETE"
]
},
"ErrorMessage": ""
}
]
}
- Developer: @zomasec
- Contributor: @h0tak88r (Sallam)
- Recheck at the preflight request correct usage
- Add http test origin
- Enhance the output of the tool (Adding description and explot and ...)
- add ability to control the output drom the user by adding flag like -d