Community程式設計與開發github.com

yaklang/cors-cross-origin-misconfiguration

CORS 配置錯誤測試手冊。用於分析跨域信任、憑證瀏覽器讀取、Origin 反射、預檢策略缺陷以及基於瀏覽器對已認證 API 的存取。

cors-cross-origin-misconfiguration 是什麼？

此技能為 CORS（跨域資源共享）配置錯誤的測試手冊，專為安全研究人員與開發者設計。當需要分析跨域信任機制時，它提供了完整的測試流程，包括如何測試帶有憑證的瀏覽器跨域讀取、Origin 反射漏洞（伺服器不當回傳 Access-Control-Allow-Origin）、預檢（preflight）請求策略中的缺陷，以及如何從瀏覽器端存取需要認證的 API。該技能支援常見的開發與測試平台（如 Claude Code、Cursor、Codex），並基於 SKILL.md 文件中的結構化指引進行操作。透過模擬跨域請求與檢查回應標頭，使用者能快速確認是否存在不安全的 CORS 配置，並獲得修復建議。此技能涵蓋了從基本測試到進階繞過技術，例如利用空 Origin 或反射漏洞來觸發瀏覽器跨域存取，有助於提升 Web 應用的安全性。

相容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/yaklang/hack-skills/tree/main/skills/cors-cross-origin-misconfiguration

Installed? Explore more 程式設計與開發 skills: steipete/bluebubbles, steipete/eightctl, steipete/blucli · View all 6 →

查看原文→瀏覽所有技能

在你喜歡的 AI 中提問

開啟一個已預先載入此 Agent Skill 的新對話。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

說明文件

cors-cross-origin-misconfiguration 是做什麼的？

CORS 配置錯誤測試手冊。用於分析跨域信任、憑證瀏覽器讀取、Origin 反射、預檢策略缺陷以及基於瀏覽器對已認證 API 的存取。

概述

本技能提供一套系統化的 CORS 配置錯誤測試方法，適用於安全測試與開發階段。通過模擬不同來源的請求，檢查伺服器回應中的 CORS 相關標頭（Access-Control-Allow-Origin、Access-Control-Allow-Credentials 等），以識別潛在的安全弱點。

主要功能

  • 測試 Origin 反射漏洞（伺服器不當回傳客戶端 Origin）
  • 檢測危險的 Access-Control-Allow-Origin: * 與憑證標頭組合
  • 檢查預檢請求（OPTIONS）的回應策略
  • 驗證瀏覽器跨域讀取敏感 API 的能力
  • 報告不安全配置並提供修復建議

使用方法

  1. 定義目標 API 端點
  2. 設定測試 Origin（如 https://evil.com、空 Origin、null Origin）
  3. 發送帶有自訂 Origin 的測試請求
  4. 分析回應標頭
  5. 根據結果生成報告

支援平台

  • Claude Code
  • Cursor
  • Codex
  • 其他基於 YAK 語言的工具

環境需求

  • yakit 或 yak 引擎
  • 目標 API 可被外部存取
  • 測試時避免影響生產環境

參考資料

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

yaklang/401-403-bypass-techniques

401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.

yaklang/active-directory-acl-abuse

Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.

yaklang/active-directory-certificate-services

AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.

yaklang/active-directory-kerberos-attacks

Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegation abuse, or pass-the-ticket attacks.

yaklang/ai-ml-security

AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealing, data privacy attacks (membership inference, model inversion), and autonomous agent security risks.

yaklang/android-pentesting-tricks

Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.

yaklang/anti-debugging-techniques

Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/exception handlers on Linux and Windows.

yaklang/api-auth-and-jwt-abuse

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

yaklang/api-authorization-and-bola

API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.

yaklang/api-recon-and-docs

API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.

yaklang/api-sec

Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.

yaklang/arbitrary-write-to-rce

Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it into code execution by targeting GOT, hooks, _IO_FILE vtable, exit_funcs, TLS_dtor_list, modprobe_path, .fini_array, or C++ vtables.

yaklang/authbypass-authentication-flaws

Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force resistance, and session boundary flaws.

yaklang/auth-sec

Entry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, and enterprise SSO weaknesses before any deeper auth topic skill.

yaklang/binary-protection-bypass

Binary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF binaries to enable exploitation.

yaklang/browser-exploitation-v8

Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination, and V8 sandbox bypass to achieve renderer RCE and sandbox escape in Chrome/Chromium.

yaklang/business-logic-vuln

Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.

yaklang/business-logic-vulnerabilities

Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.

yaklang/classical-cipher-analysis

Classical cipher analysis playbook. Use when encountering substitution ciphers, Vigenere, transposition, XOR, or encoded text in CTF challenges that requires frequency analysis, Kasiski examination, or known-plaintext cryptanalysis.

yaklang/clickjacking

Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.

相關技能

steipete/bluebubbles

Send and manage iMessages via BlueBubbles, including attachments, tapbacks, edits, replies, and groups.

community

steipete/eightctl

Control Eight Sleep pods (status, temperature, alarms, schedules).

community

steipete/blucli

BluOS CLI (blu) for discovery, playback, grouping, and volume.

community

steipete/bear-notes

Create, search, and manage Bear notes via grizzly CLI.

community

steipete/camsnap

Capture frames or clips from RTSP/ONVIF cameras.

community

steipete/gifgrep

Search GIF providers with CLI/TUI, download results, and extract stills/sheets.

community
← More 程式設計與開發 skills