[{"data":1,"prerenderedAt":325},["ShallowReactive",2],{"announcement":3,"i-tabler:sun":11,"i-tabler:moon":16,"i-tabler:menu-2":18,"i-tabler:x":20,"i-simple-icons:youtube":22,"i-simple-icons:github":24,"i-simple-icons:x":26,"i-simple-icons:linkedin":28,"i-tabler:arrow-up-right":31,"post-cors-like-youve-never-seen":33,"post-nav-cors-like-youve-never-seen":306,"video-cors-like-youve-never-seen":317},{"startsAt":4,"endsAt":5,"scramble":6,"cta":7,"message":10},"2026-10-13","2026-11-30","Cache Poisoning:",{"href":8,"label":9},"\u002Fcache-poisoning-the-cache-you-cant-purge","Read it","The cache you can't purge.",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":15},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":23},"\u003Cpath fill=\"currentColor\" d=\"M23.498 6.186a3.02 3.02 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.02 3.02 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.02 3.02 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.02 3.02 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814M9.545 15.568V8.432L15.818 12z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":25},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":27},"\u003Cpath fill=\"currentColor\" d=\"M14.234 10.162L22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299l-.929-1.329L3.076 1.56h3.182l5.965 8.532l.929 1.329l7.754 11.09h-3.182z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":29,"hidden":30},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":32},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M17 7L7 17M8 7h9v9\"\u002F>",{"id":34,"title":35,"body":36,"categories":292,"coverImage":295,"date":296,"description":297,"draft":14,"extension":298,"meta":299,"navigation":30,"noindex":14,"path":300,"readingTime":301,"seo":302,"slug":303,"stem":303,"updatedAt":304,"youtubeId":42,"__hash__":305},"blog\u002Fcors-like-youve-never-seen.md","CORS Like You’ve Never Seen",{"type":37,"value":38,"toc":283},"minimark",[39,43,51,59,66,95,111,117,138,153,159,171,189,195,206,225,231,245,267,278],[40,41],"post-media",{"video":42},"2BjOI-cwT88",[44,45,46,47,50],"p",{},"When I first started seeing CORS bugs, I thought… “Okay, cool, but this is probably nothing serious.”",[48,49],"br",{},"\nWrong.",[44,52,53,54,58],{},"In this breakdown, we’ll hit the ",[55,56,57],"strong",{},"4 most dangerous CORS mistakes"," I keep finding, how to spot them fast, and why they can lead to account takeover, data leaks, and even complete system compromise.",[60,61,63],"h3",{"id":62},"_1-the-wildcard-disaster",[55,64,65],{},"1. The Wildcard Disaster",[44,67,68,69,73,74,77,78,77,82,85,86,89,90,92],{},"When ",[70,71,72],"code",{},"Access-Control-Allow-Origin"," is set to ",[70,75,76],{},"*"," ",[79,80,81],"em",{},"and",[70,83,84],{},"Access-Control-Allow-Credentials"," is ",[70,87,88],{},"true",", you’ve basically given any origin full access to your authenticated data.",[48,91],{},[55,93,94],{},"What to check:",[96,97,98,105,108],"ul",{},[99,100,101,102,104],"li",{},"Send an Origin header with any random domain, if the response allows it ",[79,103,81],{}," credentials, you’re in.",[99,106,107],{},"Look for sensitive API responses that return user data, tokens, or configuration.",[99,109,110],{},"Test both GET and POST requests, some endpoints are protected differently.",[60,112,114],{"id":113},"_2-the-reflection-trap",[55,115,116],{},"2. The Reflection Trap",[44,118,119,120,122,123,125,126,129,130,133,134,136],{},"The server takes whatever Origin you send… and reflects it back in the ",[70,121,72],{}," header.",[48,124],{},"\nWith ",[70,127,128],{},"Access-Control-Allow-Credentials: true",", this becomes dangerous: your malicious site can make the request ",[79,131,132],{},"as the victim",", and the browser will happily send their cookies.",[48,135],{},[55,137,94],{},[96,139,140,143,150],{},[99,141,142],{},"Can you grab an authenticated API response from your own domain?",[99,144,145,146,149],{},"Does the site cache the response headers? If yes, think ",[55,147,148],{},"cache poisoning",": you can poison it once, and every visitor gets the bad header.",[99,151,152],{},"Test across subdomains, sometimes only part of the app is vulnerable.",[60,154,156],{"id":155},"_3-the-wordpress-api-trap",[55,157,158],{},"3. The WordPress API Trap",[44,160,161,162,165,166,168],{},"A lot of WP sites leave ",[70,163,164],{},"\u002Fwp-json\u002F"," open to the world with permissive CORS rules.",[48,167],{},[55,169,170],{},"Why it’s bad:",[96,172,173,176,183,186],{},[99,174,175],{},"Many plugins and themes expose sensitive or admin-only endpoints through this API.",[99,177,178,179,181],{},"Some allow reading draft posts, user emails, or even nonce tokens.",[48,180],{},[55,182,94],{},[99,184,185],{},"See if authenticated-only data is exposed when cookies are sent.",[99,187,188],{},"Check plugin-specific API routes for private data leaks.",[60,190,192],{"id":191},"_4-the-ruby-breakdown",[55,193,194],{},"4. The Ruby Breakdown",[44,196,197,198,201,202,204],{},"Rails apps often use the ",[70,199,200],{},"rack-cors"," gem, and if it’s misconfigured, you can access internal or authenticated endpoints from anywhere.",[48,203],{},[55,205,94],{},[96,207,208,219,222],{},[99,209,210,211,214,215,218],{},"Look for ",[70,212,213],{},"origins '*'"," with ",[70,216,217],{},"credentials: true",".",[99,220,221],{},"See if specific controllers or environments override CORS rules inconsistently.",[99,223,224],{},"Always test staging environments, dev teams often forget to lock them down.",[60,226,228],{"id":227},"_5-tools-to-catch-it-fast",[55,229,230],{},"5. Tools to Catch It Fast",[96,232,233,239],{},[99,234,235,238],{},[55,236,237],{},"Corsy",": quick CORS scanner for broad sweeps.",[99,240,241,244],{},[55,242,243],{},"Scanner (Caido Plugin)",": catch CORS along with other bug classes during recon.",[44,246,247,250,252,253,255,256,259,260,263,264,266],{},[55,248,249],{},"The Real Hacker Mindset",[48,251],{},"\nMost hunters shrug at CORS. They see it as “informational” and move on.",[48,254],{},"\nBut combine it with ",[55,257,258],{},"XSS",", ",[55,261,262],{},"CSRF",", or ",[55,265,148],{},", and you’re looking at account takeover, password resets, or sensitive data exfiltration.",[44,268,269,272,274,275,277],{},[55,270,271],{},"Final Words",[48,273],{},"\nThe next time you see a “boring” CORS issue… stop. Test it. Chain it. Escalate it.",[48,276],{},"\nThe boring bugs are often the ones with the biggest payouts.",[44,279,280],{},[55,281,282],{},"Stay curious, and stay secure. 🔐🔥",{"title":284,"searchDepth":285,"depth":285,"links":286},"",3,[287,288,289,290,291],{"id":62,"depth":285,"text":65},{"id":113,"depth":285,"text":116},{"id":155,"depth":285,"text":158},{"id":191,"depth":285,"text":194},{"id":227,"depth":285,"text":230},[293,294],"Bug Bounty","Penetration Testing","\u002Fimages\u002Fblog\u002Fcors-like-youve-never-seen\u002Fcors-like-youve-never-seen.webp","2025-08-15","Wildcard origins, reflected origins and the WordPress API trap: the CORS misconfigurations that lead to account takeover, and how to spot them fast.","md",{},"\u002Fcors-like-youve-never-seen",null,{"title":35,"description":297},"cors-like-youve-never-seen","2025-08-21","S2TOLDx09PHfpsn63uXcLOGbwcQ_fi7u6iZc3BlkcI4",{"older":307,"newer":311,"total":316},{"slug":308,"title":309,"date":310,"position":13},"forget-low-hanging-fruit-hunt-these-instead","Forget Low-Hanging Fruit. Hunt These Instead","2025-08-09",{"slug":312,"title":313,"date":314,"position":315},"stop-guessing-start-hunting-the-roadmap","Stop Guessing. Start Hunting. (The Roadmap)","2025-08-25",22,68,{"id":42,"title":35,"published":318,"url":319,"description":320,"durationSeconds":321,"viewCount":322,"thumbnail":323,"thumbnailSrcset":324},"2025-08-21T07:00:02Z","https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=2BjOI-cwT88","In this deep-dive episode, we’re pulling back the curtain on CORS misconfigurations — the bug that most hunters ignore, underrate, or report without real impact. I’ll show you why CORS can be way more dangerous than it looks, how to chain it into something critical, and real-world examples from experience and bug…",831,1777,"\u002Fimages\u002Fvideos\u002F2BjOI-cwT88-800.webp","\u002Fimages\u002Fvideos\u002F2BjOI-cwT88-800.webp 800w, \u002Fimages\u002Fvideos\u002F2BjOI-cwT88-1280.webp 1280w",1791941258711]