Fire a battery of crafted-Origin probes to find credential-exposing CORS misconfigurations - with an auto-generated exploit PoC.
CORS Misconfig Tester sends a parallel battery of requests with crafted Origin headers and inspects how the server answers in Access-Control-Allow-Origin (ACAO) and Access-Control-Allow-Credentials (ACAC). Permissive combinations can let any site read a victim’s authenticated responses.
It goes beyond a single reflected-origin check: it tests the bypass classes that catch real targets - arbitrary origin, null, arbitrary sub-domain, prefix/suffix regex bugs and HTTP-downgrade trust - runs a pre-flight (OPTIONS) check, and gives each probe a credentials-aware verdict.
When a vector is exploitable it builds a ready-to-host PoC (a credentialed fetch, or a sandboxed-iframe PoC for null origin) so you can demonstrate impact immediately.
Not always - impact depends on whether credentials are allowed and the endpoint returns sensitive, cookie-gated data. The tool ranks each probe (credentials-aware) and only calls a vector exploitable when ACAC is true; you confirm the data exposure.
The PoC is generated client-side for your own use and is not executed by us - it targets the URL you tested and exfiltrates to a placeholder you replace with your own collector. Only use it against assets you are authorised to test.