Scan Web Application Vulnerabilities
Run comprehensive vulnerability scans against web applications to identify security weaknesses.
Test CORS Security Configuration
Check Cross-Origin Resource Sharing configurations for misconfigurations that could allow unauthorized data access.
ToolCORS (Cross-Origin Resource Sharing) misconfigurations are among the most common and dangerous web security issues. A misconfigured CORS policy can allow any website to make authenticated requests to your API and read the responses, effectively bypassing the same-origin policy that browsers use to protect users.
The most dangerous misconfiguration is reflecting the Origin header back in Access-Control-Allow-Origin with credentials allowed. This means any website can read authenticated data from your API just by making a fetch request from a malicious page. Other risky configurations include allowing null origins, using overly broad wildcards, or trusting subdomains that could be compromised.
CORS testing verifies that your application only allows cross-origin requests from trusted domains. It checks for origin reflection, null origin handling, wildcard usage, credential exposure, and preflight response consistency. This is critical for any application with an API that handles sensitive data, especially single-page applications where the frontend and API are on different origins.
Agent Guides
Claude
- Connect ToolRouter: claude mcp add toolrouter -- npx -y toolrouter-mcp
- Ask Claude: "Test the CORS configuration of my application using pentest" and provide the URL
- Claude sends cross-origin requests with various Origin headers and analyzes responses
ChatGPT
- Configure ToolRouter in ChatGPT
- Ask: "Test my API's CORS configuration for security issues" and provide the URL
- ChatGPT probes CORS headers and returns findings
Copilot
- Add ToolRouter to Copilot MCP config
- In Copilot Chat: "Test my API's CORS configuration" and provide the URL
- Copilot tests CORS headers and returns findings
OpenClaw
- Connect ToolRouter: openclaw mcp add toolrouter -- npx -y toolrouter-mcp
- Ask OpenClaw: "Test the CORS configuration of my API"
- OpenClaw probes cross-origin headers and reports findings
Related Use Cases
Test API Security
Assess the security of REST APIs by testing authentication, authorization, input validation, and injection resistance.
Check for SQL Injection Vulnerabilities
Test web applications and APIs for SQL injection vulnerabilities that could expose database contents.
Test for Cross-Site Scripting (XSS)
Detect XSS vulnerabilities where user input is reflected or stored without proper sanitization.