misc update

vulnerabilities/generic/cors-misconfig.yaml

@@ -16,31 +16,28 @@ requests:
       - |
         GET / HTTP/1.1
         Host: {{Hostname}}
-        Origin: {{randstr}}.com
+        Origin: {{randstr}}.tld
 
       - |
         GET / HTTP/1.1
         Host: {{Hostname}}
         Origin: null
 
-#      - |
-#        GET / HTTP/1.1
-#        Host: {{Hostname}}
+#  TODO's for future as currently {{Hostname}} is not supported in matchers
 #        Origin: {{randstr}}.{{Hostname}}
-#
-#      - |
-#        GET / HTTP/1.1
-#        Host: {{Hostname}}
-#        Origin: {{Hostname}}{{randstr}}
-
-# TO DO for future as currently {{Hostname}} is not supported in matchers
+#        Origin: {{Hostname}}.{{randstr}}.tld
+#        Origin: {{Hostname}}{{randstr}}.tld
+#        Origin: {{Hostname}}_.{{randstr}}.tld
+#        Origin: {{Hostname}}%60.{{randstr}}.tld
+#        Origin: http://{{Hostname}}
+#        Origin: http://{{randstr}}.{{Hostname}}
 
     matchers-condition: or
     matchers:
       - type: dsl
         name: arbitrary-origin
         dsl:
-          - "contains(tolower(all_headers), 'access-control-allow-origin: {{randstr}}.com')"
+          - "contains(tolower(all_headers), 'access-control-allow-origin: {{randstr}}.tld')"
           - "contains(tolower(all_headers), 'access-control-allow-credentials: true')"
         condition: and