Tools›CORS Scanner
webFast

CORS Scanner

Cross-Origin Resource Sharing Analyzer

"Tests for CORS misconfigurations that allow malicious sites to read your API responses."

▶ Scan with CORS Scanner
Overview

CORS (Cross-Origin Resource Sharing) controls which websites are allowed to make cross-origin requests to your API. A misconfigured CORS policy can allow any website on the internet to make authenticated requests to your API and read the responses — effectively allowing attackers to steal data from your users.

The most dangerous misconfigurations are: allowing all origins with credentials, reflecting the request's Origin header back without validation, and allowing null origins. CORS Scanner sends targeted requests that test for these patterns specifically.

Example findings
CRITICALCORS — Arbitrary Origin Reflected with Credentials
HIGHCORS — Null Origin Accepted (Sandboxed Iframe Attack)
HIGHCORS — Wildcard Origin with Credentials Enabled
MEDIUMCORS — Overly Broad Origin Pattern Accepted
What it discovers
  • ▸Wildcard CORS with credentials enabled (critical misconfiguration)
  • ▸Origin reflection without validation
  • ▸Null origin accepted (exploitable from sandboxed iframes)
  • ▸Overly permissive CORS headers on sensitive endpoints