rub-nds/corstest

A simple CORS misconfiguration scanner

corstest's Issues

Added to Blackarch

Added to Blackarch: BlackArch/blackarch#1726
Feel free to change or inform me if any changes are needed.

NameError: global name 'args' is not defined

Am getting below error, can you please help to resolve?
OS:Win 7

Traceback (most recent call last):
File "C:\Users\kandasam\CORStest\corstest.py", line 112, in
main()
File "C:\Users\kandasam\CORStest\corstest.py", line 31, in main
try: pool.map_async(check, urls).get(2**32)
File "C:\Users\kandasam.windows-build-tools\python27\lib\multiprocessing\pool.py", line 567, in get
raise self._value
NameError: global name 'args' is not defined

python3 support

Hi, I'm wondering if you will be upgrading the tool soon.
As you might be aware, all linux distributions removing python2 starting from this year.
So we (Pentoo) have no choice but to remove all packages which support python2 only.

IOError, ValueError in corstest line 26

when user run it as
python corstest.py -q domain.com

then it is showing an error -
File "corstest.py", line 26
except (IOError, ValueError) as e: print e; return
^

Access-Control-Allow-Origin Header not correctly detected

despite the importance of the tool and it's purpose ( I really appreciate it ) but the results was not promising in some situation, for example on trying the tool

the result was as above and the cause was presented 0a7600c1033c1375c0b5ac1800ae0002.web-security-academy.net/my-account - Not vulnerable: Access-Control-Allow-Origin header not present
while I (the solution OC) just added the Origin: hello.com header to detect it

I suggest with ❤ U may add the header automatically if not presented in the original request that could increase the chance to detect the Vulnerability .

How can this be used local pages like router pages ?

I want to test it on my router ...
What are the required steps ?