Add new payload for CORS

vulnerabilities/generic/cors-misconfig.yaml

@@ -2,7 +2,7 @@ id: cors-misconfig
 
 info:
   name: CORS Misconfiguration
-  author: nadino,g4l1t0,convisoappsec,pdteam,breno_css
+  author: nadino,g4l1t0,convisoappsec,pdteam,breno_css,nodauf
   severity: info
   reference:
     - https://portswigger.net/web-security/cors
@@ -28,6 +28,9 @@ requests:
         - "null"                                              # null origin
         - "https://{{tolower(rand_base(5))}}.{{RDN}}"         # Arbitrary subdomain
         - "http://{{tolower(rand_base(5))}}.{{RDN}}"          # Arbitrary subdomain over http
+        - "https://{{replace(FQDN,'.','a')}}"          # Replace . by a random character to abuse if regex is used
+        - "http://{{replace(FQDN,'.','a')}}"          # Replace . by a random character to abuse if regex is used
+
 
     stop-at-first-match: true
     matchers: