# CorsMe | Cross Origin Resource Sharing MisConfiguration Scanner

**URL:** <https://onehack.st/t/corsme-cross-origin-resource-sharing-misconfiguration-scanner/93697>\
**Category:** Tools & Scripts\
**Tags:** tools, freebies, documents\
**Created:** [June 25, 2020, 3:30pm UTC](https://onehack.st/t/corsme-cross-origin-resource-sharing-misconfiguration-scanner/93697 "2020-06-25T15:30:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [June 25, 2020, 3:30pm UTC](https://onehack.st/t/corsme-cross-origin-resource-sharing-misconfiguration-scanner/93697/1 "2020-06-25T15:30:34Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/6/b/6b5f1f04a4a44e82f0267c35072372c7ad5dd2e8.png)

## What is CorsMe ?

A cors misconfiguration scanner tool based on golang with speed and precision in mind !

## Misconfiguration type this scanner can check for

- Reflect Origin checks
- Prefix Match
- Suffix Match
- Not Esacped Dots
- Null
- ThirdParties (Like =\> [github.io](http://github.io), repl.it etc.)
  - Taken from [Chenjj’s github repo](https://github.com/chenjj/CORScanner/blob/master/origins.json)

- SpecialChars (Like =\> “}”,“(”, etc.)
  - See more in [Advanced CORS Exploitation Techniques](https://www.corben.io/advanced-cors-techniques/)

## How to Install

```auto
$ go get -u github.com/shivangx01b/CorsMe

```

## Usage

Single Url

```auto
echo "https://example.com" | ./CorsMe 

```

Multiple Url

```auto
cat http_https.txt | ./CorsMe -t 70

```

Allow wildcard .. Now if Access-Control-Allow-Origin is \* it will be printed

```auto
cat http_https.txt | ./CorsMe -t 70 --wildcard

```

Add header if required

```auto
cat http_https.txt | ./CorsMe -t 70 -wildcard -header "Cookie: Session=12cbcx...."

```

Tip

```auto
cat subdomains.txt | ./httprobe -c 70 -p 8080,8081,8089 | tee http_https.txt
cat http_https.txt | ./CorsMe -t 70

```

## Screenshot

 ![image](https://onehack.st/uploads/default/original/3X/3/6/36a427e15043ba74cb453bce8508c95f0f46c81c.png)

[![Twitter](https://camo.githubusercontent.com/d1bdd1a51691dfa4771418850eaf7b63da828f24/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f747769747465722d40316e6469616e6c3333742d626c75652e737667)](https://twitter.com/1ndianl33t)

## Ideas for making this tool are taken from :

[CORScanner](https://github.com/chenjj/CORScanner)

[Corsy](https://github.com/s0md3v/Corsy)

[cors-blimey](https://github.com/tomnomnom/hacks/tree/master/cors-blimey)

## GitHub:

> **[GitHub - Shivangx01b/CorsMe: Cross Origin Resource Sharing MisConfiguration...](https://github.com/Shivangx01b/CorsMe)**
>
> Cross Origin Resource Sharing MisConfiguration Scanner