Arsenly
Tools
Free Tools
Pricing
Resources
Sign in Get started
← All tools

CORS Misconfig Tester

Web Security Audit

Fire a battery of crafted-Origin probes to find credential-exposing CORS misconfigurations - with an auto-generated exploit PoC.

What is CORS Misconfig Tester?

CORS Misconfig Tester sends a parallel battery of requests with crafted Origin headers and inspects how the server answers in Access-Control-Allow-Origin (ACAO) and Access-Control-Allow-Credentials (ACAC). Permissive combinations can let any site read a victim’s authenticated responses.

It goes beyond a single reflected-origin check: it tests the bypass classes that catch real targets - arbitrary origin, null, arbitrary sub-domain, prefix/suffix regex bugs and HTTP-downgrade trust - runs a pre-flight (OPTIONS) check, and gives each probe a credentials-aware verdict.

When a vector is exploitable it builds a ready-to-host PoC (a credentialed fetch, or a sandboxed-iframe PoC for null origin) so you can demonstrate impact immediately.

What it tests

  • Arbitrary origin reflection - does the server echo any Origin into ACAO?
  • Null origin - acceptance of Origin: null, reachable from sandboxed iframes / data: documents.
  • Arbitrary sub-domain trust - accepts any *.target, exploitable via sub-domain takeover or XSS.
  • Prefix / suffix regex bugs - startsWith/endsWith checks an attacker domain can satisfy.
  • HTTP-downgrade trust - an http:// origin accepted on an HTTPS endpoint.
  • Credentialed wildcard - ACAO with ACAC: true, the classic data-exfiltration setup.
  • Pre-flight behavior - how OPTIONS handles non-simple methods and custom headers.
  • Auto PoC - a copy-paste exploit page for any exploitable vector.

Where it fits in your workflow

  • Confirm whether a cross-origin data-theft scenario is actually exploitable.
  • Demonstrate impact for an authenticated API endpoint with a working PoC.
Use CORS Misconfig Tester

Run it from your dashboard.

Create free account Sign in Use via API

At a glance

CategoryWeb Security Audit
RunsServer-side
Token cost 3 / run (free tier)
Access Pro
Status● Live

Frequently asked questions

Does a reflected origin always mean a vulnerability?

Not always - impact depends on whether credentials are allowed and the endpoint returns sensitive, cookie-gated data. The tool ranks each probe (credentials-aware) and only calls a vector exploitable when ACAC is true; you confirm the data exposure.

Is the PoC safe to run?

The PoC is generated client-side for your own use and is not executed by us - it targets the URL you tested and exfiltrates to a placeholder you replace with your own collector. Only use it against assets you are authorised to test.

Explore more tools →