Corsy is a lightweight program that scans for all known misconfigurations in CORS implementations.
Corsy only works with Python 3 and has the following depencies:
tldrequests
To install these dependencies, navigate to Corsy directory and execute pip3 install -r requirements.txt
Using Corsy is pretty simple
python3 corsy.py -u https://example.com
A delay between consecutive requests can be specified with -d option.
If you want to build the container yourself manually, git clone the repo, then build and run the following commands
- Clone the repo using
git clone https://github.com/s0md3v/Corsy - Build your docker container
docker build -t corsy .- After building the container using either way, run the following -
docker run -it corsy -u https://example.comNote: This is a beta version, features such as JSON output and scanning multiple hosts will be added later.
- Pre-domain bypass
- Post-domain bypass
- Backtick bypass
- Null origin bypass
- Unescaped dot bypass
- Invalid value
- Wild card value
- Origin reflection test
- Third party allowance test
- HTTP allowance test
Liked the project? Donate a few bucks to motivate me to keep writing code for free.
