daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10748 from Osb0rn3/main 

CORS misconfig improvements
patch-12
Prince Chaddha 2024-10-07 16:42:36 +07:00 committed by GitHub
parent dbb5370b49 de57c593e8
commit 2cd552e588
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
http/vulnerabilities/generic/cors-misconfig.yaml
View File

@ -2,14 +2,15 @@ id: cors-misconfig
info: info:
name: CORS Misconfiguration name: CORS Misconfiguration
author: nadino,g4l1t0,convisoappsec,pdteam,breno_css,nodauf author: nadino,g4l1t0,convisoappsec,pdteam,breno_css,nodauf,amirmsafari
severity: info severity: info
reference: reference:
- https://portswigger.net/web-security/cors - https://portswigger.net/web-security/cors
- https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet
- https://www.corben.io/advanced-cors-techniques/ - https://www.corben.io/advanced-cors-techniques/
- https://www.geekboy.ninja/blog/exploiting-misconfigured-cors-cross-origin-resource-sharing/ - https://www.geekboy.ninja/blog/exploiting-misconfigured-cors-cross-origin-resource-sharing/
metadata: metadata:
max-request: 11 max-request: 29
tags: cors,generic,misconfig tags: cors,generic,misconfig
http: http:
@ -22,11 +23,29 @@ http:
payloads: payloads:
cors_origin: cors_origin:
- "https://{{tolower(rand_base(5))}}{{RDN}}" # Arbitrary domain - "https://{{tolower(rand_base(5))}}{{RDN}}" # Arbitrary domain
- "http://{{tolower(rand_base(5))}}{{RDN}}" # Arbitrary domain
- "https://{{tolower(rand_base(5))}}.com" # Arbitrary domain - "https://{{tolower(rand_base(5))}}.com" # Arbitrary domain
- "https://{{FQDN}}.{{tolower(rand_base(5))}}.com" # Arbitrary domain - "https://{{FQDN}}.{{tolower(rand_base(5))}}.com" # Arbitrary domain
- "https://{{FQDN}}{{tolower(rand_base(5))}}.com" # Arbitrary domain - "https://{{FQDN}}{{tolower(rand_base(5))}}.com" # Arbitrary domain
- "https://localhost.{{tolower(rand_base(5))}}.com" # Localhost regex implementation edge case
- "http://localhost.{{tolower(rand_base(5))}}.com" # Localhost regex implementation edge case over http
- "http://s{{RDN}}" # Unencrypted domain ends with
- "https://{{FQDN}}_.{{tolower(rand_base(5))}}.com" # Arbitrary domain - "https://{{FQDN}}_.{{tolower(rand_base(5))}}.com" # Arbitrary domain
- "https://{{FQDN}}%60.{{tolower(rand_base(5))}}.com" # Arbitrary domain - "https://{{FQDN}}%60.{{tolower(rand_base(5))}}.com" # Arbitrary domain
- "https://{{FQDN}}.$.{{tolower(rand_base(5))}}.com" # Firefox and Safari allows $ as subdomain
- "https://{{FQDN}}.~.{{tolower(rand_base(5))}}.com" # Safari allows ~ as subdomain
- "https://{{FQDN}}.=.{{tolower(rand_base(5))}}.com" # Safari allows = as subdomain
- "https://{{FQDN}}.+.{{tolower(rand_base(5))}}.com" # Firefox and Safari allows + as subdomain
- "https://{{FQDN}}.&.{{tolower(rand_base(5))}}.com" # Safari allows & as subdomain
- "https://{{FQDN}}.*.{{tolower(rand_base(5))}}.com" # Safari allows * as subdomain
- "https://{{FQDN}}.).{{tolower(rand_base(5))}}.com" # Safari allows ) as subdomain
- "https://{{FQDN}}.(.{{tolower(rand_base(5))}}.com" # Safari allows ( as subdomain
- "https://{{FQDN}}.'.{{tolower(rand_base(5))}}.com" # Safari allows ' as subdomain
- "https://{{FQDN}}.!.{{tolower(rand_base(5))}}.com" # Safari allows ! as subdomain
- "https://{{FQDN}}.;.{{tolower(rand_base(5))}}.com" # Safari allows ; as subdomain
- "https://{{FQDN}}.,.{{tolower(rand_base(5))}}.com" # Safari allows , as subdomain
- "https://{{FQDN}}.-.{{tolower(rand_base(5))}}.com" # Arbitrary domain
- "https://{{FQDN}}._.{{tolower(rand_base(5))}}.com" # Arbitrary domain
- "null" # null origin - "null" # null origin
- "https://{{tolower(rand_base(5))}}.{{RDN}}" # Arbitrary subdomain - "https://{{tolower(rand_base(5))}}.{{RDN}}" # Arbitrary subdomain
- "http://{{tolower(rand_base(5))}}.{{RDN}}" # Arbitrary subdomain over http - "http://{{tolower(rand_base(5))}}.{{RDN}}" # Arbitrary subdomain over http