# Corsy | CORS Misconfiguration Scanner

**URL:** <https://onehack.st/t/corsy-cors-misconfiguration-scanner/223297>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, tips-tricks\
**Created:** [August 31, 2022, 8:41pm UTC](https://onehack.st/t/corsy-cors-misconfiguration-scanner/223297 "2022-08-31T20:41:16Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Astrid](https://onehack.st/user_avatar/onehack.st/astrid/32/174869_2.png) [@Astrid](https://onehack.st/u/Astrid)\
**Post date:** [August 31, 2022, 8:41pm UTC](https://onehack.st/t/corsy-cors-misconfiguration-scanner/223297/1 "2022-08-31T20:41:17Z")

</div>

# 

[![Corsy](https://camo.githubusercontent.com/6a2f1961a2297d3e7274b5ee998174dfe0c55a916adf31c0d373bc59890526de/68747470733a2f2f692e6962622e636f2f4b305a375839392f636f7273792e706e67)](https://github.com/s0md3v/Corsy)  
Corsy

#### CORS Misconfiguration Scanner

[![](https://camo.githubusercontent.com/ee2972d638f840146c335c40975c68847ffa6d288dfca760470ada6c1475b8bc/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f73306d6433762f436f7273792e737667) ](https://github.com/s0md3v/Corsy/releases)[![](https://camo.githubusercontent.com/9e7573ddd9aa97b59aff2f5825e8e03b7a99ec18aa01ede784077b877f67af56/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6973737565732d636c6f7365642d7261772f73306d6433762f436f7273792e737667)](https://github.com/s0md3v/Corsy/issues?q=is%3Aissue+is%3Aclosed)

### Introduction

Corsy is a lightweight program that scans for all known misconfigurations in CORS implementations.

[![demo](https://camo.githubusercontent.com/fe9a3bbe75dadd3d3427644e7bd585a8316d717344856731379083e437f25f50/68747470733a2f2f692e6962622e636f2f4a633148746d572f636f7273792e706e67)](https://camo.githubusercontent.com/fe9a3bbe75dadd3d3427644e7bd585a8316d717344856731379083e437f25f50/68747470733a2f2f692e6962622e636f2f4a633148746d572f636f7273792e706e67)

### Requirements

Corsy only works with `Python 3` and has just one dependency:

- `requests`

To install this dependency, navigate to Corsy directory and execute `pip3 install requests`

### Usage

Using Corsy is pretty simple

`python3 corsy.py -u https://example.com`

##### Scan URLs from a file

`python3 corsy.py -i /path/urls.txt`

##### Scan URLs from stdin

`cat urls.txt | python3 corsy.py`

##### Number of threads

`python3 corsy.py -u https://example.com -t 20`

##### Delay between requests

`python3 corsy.py -u https://example.com -d 2`

##### Export results to JSON

`python3 corsy.py -i /path/urls.txt -o /path/output.json`

##### Custom HTTP headers

`python3 corsy.py -u https://example.com --headers "User-Agent: GoogleBot\nCookie: SESSION=Hacked"`

##### Skip printing tips

`-q` can be used to skip printing of `description`, `severity`, `exploitation` fields in the output.

### Tests implemented

- Pre-domain bypass
- Post-domain bypass
- Backtick bypass
- Null origin bypass
- Unescaped dot bypass
- Underscore bypass
- Invalid value
- Wild card value
- Origin reflection test
- Third party allowance test
- HTTP allowance test

## GitHub:

[https://github.com/s0md3v/Corsy](https://github.com/s0md3v/Corsy)