s0md3v / corsy Goto Github PK

View Code? Open in Web Editor NEW

1.3K 31.0 170.0 83 KB

CORS Misconfiguration Scanner

License: GNU General Public License v3.0

Python 100.00%

cors cors-misconfiguration-scanner cors-scanner vulnerability-scanner

corsy's Introduction

Corsy

CORS Misconfiguration Scanner

Introduction

Corsy is a lightweight program that scans for all known misconfigurations in CORS implementations.

Requirements

Corsy only works with Python 3 and has just one dependency:

requests

To install this dependency, navigate to Corsy directory and execute pip3 install requests

Usage

Using Corsy is pretty simple

python3 corsy.py -u https://example.com

Scan URLs from a file

python3 corsy.py -i /path/urls.txt

Scan URLs from stdin

cat urls.txt | python3 corsy.py

Number of threads

python3 corsy.py -u https://example.com -t 20

Delay between requests

python3 corsy.py -u https://example.com -d 2

Export results to JSON

python3 corsy.py -i /path/urls.txt -o /path/output.json

Custom HTTP headers

python3 corsy.py -u https://example.com --headers "User-Agent: GoogleBot\nCookie: SESSION=Hacked"

Skip printing tips

-q can be used to skip printing of description, severity, exploitation fields in the output.

Tests implemented

Pre-domain bypass
Post-domain bypass
Backtick bypass
Null origin bypass
Unescaped dot bypass
Underscore bypass
Invalid value
Wild card value
Origin reflection test
Third party allowance test
HTTP allowance test

corsy's People

Contributors

Stargazers

Watchers

Forkers

midoxnet stevenndegwa 007divyachawla affilares c002 anu-bhav pflashpunk shreegowtham27 attackgithub gdraperi daudmalik06 c0d3sh3lf hehacks 0x14rp ethancck shahedkhanulab modulexcite liinns afranche crazyguitar buxxux lingnet averroes simongomez95 shaunstanislauslau nod johndoex1 antrepo ingramali vilhelmprytz bhasbor makuga01 fr34k8 paralax spencerx advac 0xrishabh askyeye lzr666666 tquentin rajivraj cyb3rjy0t rahmiy grumo35 zer0codex theblackturtle pentest-tools suhas-s-dev slooppe avineshwar 5l1v3r1 thamrius urstkj sysnap2012 sambal0x its-kangara mmg1 heartsleep m-i-6 snrtherock limkokholefork csmagee99 simhaonline polling-repo-continua element-92 not-duckie paitha28 furikuri ex624 rmahmadzai bill-bil shelld3v aminu-muhammed mysterioussonofgod prongedfork 0xflotus 1234567-glitch ktzgraph life0verflow area71 00mjk mynk0x batamhacker ganofins 3-shake develop-python righteousgambit hartl3y94 gemboxteam ashkanrafiee slayer321 gh0st0ne r3curs1v3-pr0xy tamersp25 dimension262611 gprime31 julirash hoatrangnv darknesschieftain sgwan600

corsy's Issues

Include Headers and Cookies feature for authenticated tests

Include Headers and Cookie adding feature for authenticated tests.

Not sending request to full URL if there are GET parameters

Hello,
I tried using Corsy with a URL with GET parameters and I intercepted the request with my proxy. Turns out that the sent request removes everything that comes after the ? character.

Commenting the following line in corsy.py file worked:
url = scheme + '://' + netloc + parsed.path

However, this is not a really clean solution.

re "not defined"

 root@kali:Corsy# python3 corsy.py -u https://ac5a1f601e6f1dfc80611a2c00e20022.web-security- 
 academy.net/my-account?id=wiener --headers "Cookie: 
 session=qYE4E2gzsDudWpt9iXLLGHwXtZOpfCnv"



 ＣＯＲＳＹ  {v1.0-beta}



Traceback (most recent call last):

File "corsy.py", line 46, in <module>
header_dict = extractHeaders(header_dict)
File "/root/Desktop/WPT/CORS/Corsy/core/utils.py", line 59, in extractHeaders
matches = re.findall(r'^?(.*?):\s(.*?)[\n$]', headers)
NameError: name 're' is not defined

app suddlny freez after time by 10 requets

app suddlny stop after time by 10 requets

I've been trying to run the script against URLs that look like https://example.com/foo/bar, and it looks like /foo/bar piece is being dropped, so we test only against the root domain - https://example.com. Any reason for doing that?

i have problem when i run

when i run i see this problem

name 'extractHeaders' is not defined

I ran the following command:

Command:

python3 corsy.py -u https://somesitre --headers "Cookie: somecookie Connection: close"

Got the following error:


    ＣＯＲＳＹ  {v1.0-beta}

Traceback (most recent call last):
  File "corsy.py", line 46, in <module>
    header_dict = extractHeaders(header_dict)
NameError: name 'extractHeaders' is not defined

I'm not soo good in python ..hope u can help me 👍

Self CA Handling

Hi dude,

I wanted to test my webapp using your tool and it crashes due to my SSL certificate is self-signed.

This is the crash:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 601, in urlopen
    chunked=chunked)
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 346, in _make_request
    self._validate_conn(conn)
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 852, in _validate_conn
    conn.connect()
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 326, in connect
    ssl_context=context)
  File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 332, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/usr/lib/python3.6/ssl.py", line 407, in wrap_socket
    _context=self, _session=session)
  File "/usr/lib/python3.6/ssl.py", line 817, in __init__
    self.do_handshake()
  File "/usr/lib/python3.6/ssl.py", line 1077, in do_handshake
    self._sslobj.do_handshake()
  File "/usr/lib/python3.6/ssl.py", line 689, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 440, in send
    timeout=timeout
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 639, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 398, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='sparta-barclays.labs.stratio.com', port=443): Max retries exceeded with url: /?User-Agent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A70.0%29+Gecko%2F20100101+Firefox%2F70.0&Accept=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2C%2A%2F%2A%3Bq%3D0.8&Accept-Language=en-US%2Cen%3Bq%3D0.5&Accept-Encoding=gzip&DNT=1&Connection=close&Origin=httpsexample.com (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "corsy.py", line 43, in <module>
    result = cors(target_url, delay)
  File "corsy.py", line 36, in cors
    active = active_tests(url, root, scheme, delay)
  File "/home/pruiz/Escritorio/tools/Corsy/core/tests.py", line 22, in active_tests
    acao_header = requester(url, scheme, 'example.com')
  File "/home/pruiz/Escritorio/tools/Corsy/core/requester.py", line 14, in requester
    response = requests.get(url, headers).headers
  File "/usr/lib/python3/dist-packages/requests/api.py", line 72, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/api.py", line 58, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 520, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 630, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 506, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='sparta-barclays.labs.stratio.com', port=443): Max retries exceeded with url: /?User-Agent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A70.0%29+Gecko%2F20100101+Firefox%2F70.0&Accept=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2C%2A%2F%2A%3Bq%3D0.8&Accept-Language=en-US%2Cen%3Bq%3D0.5&Accept-Encoding=gzip&DNT=1&Connection=close&Origin=httpsexample.com (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),))

Greetings,

Corsy Crash

Traceback (most recent call last):
File "/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py", line 672, in urlopen
chunked=chunked,
File "/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py", line 421, in _make_request
six.raise_from(e, None)
File "", line 3, in raise_from
File "/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py", line 416, in _make_request
httplib_response = conn.getresponse()
File "/usr/local/lib/python3.7/http/client.py", line 1321, in getresponse
response.begin()
File "/usr/local/lib/python3.7/http/client.py", line 296, in begin
version, status, reason = self._read_status()
File "/usr/local/lib/python3.7/http/client.py", line 257, in _read_status
line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1")
File "/usr/local/lib/python3.7/socket.py", line 589, in readinto
return self._sock.recv_into(b)
File "/usr/local/lib/python3.7/ssl.py", line 1052, in recv_into
return self.read(nbytes, buffer)
File "/usr/local/lib/python3.7/ssl.py", line 911, in read
return self._sslobj.read(len, buffer)
ConnectionResetError: [Errno 104] Connection reset by peer

During handling of the above exception, another exception occurred:

Feature Request

Could we have an argument to disable colored text?

Error with redirections.


    ＣＯＲＳＹ  {v1.0-beta}

 ~ Estimated scan time: 44 secs
Traceback (most recent call last):
  File "corsy.py", line 76, in <module>
    result = each.result()
  File "/usr/lib/python3.8/concurrent/futures/_base.py", line 432, in result
    return self.__get_result()
  File "/usr/lib/python3.8/concurrent/futures/_base.py", line 388, in __get_result
    raise self._exception
  File "/usr/lib/python3.8/concurrent/futures/thread.py", line 57, in run
    result = self.fn(*self.args, **self.kwargs)
  File "corsy.py", line 66, in cors
    return active_tests(url, root, scheme, header_dict, delay)
  File "/home/natsu/myproject/tools/Corsy/core/tests.py", line 26, in active_tests
    headers = requester(url, scheme, header_dict, 'example.com')
  File "/home/natsu/myproject/tools/Corsy/core/requester.py", line 9, in requester
    response = requests.get(url, headers=headers, verify=False).headers
  File "/usr/lib/python3/dist-packages/requests/api.py", line 75, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/api.py", line 60, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 533, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 668, in send
    history = [resp for resp in gen] if allow_redirects else []
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 668, in <listcomp>
    history = [resp for resp in gen] if allow_redirects else []
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 165, in resolve_redirects
    raise TooManyRedirects('Exceeded %s redirects.' % self.max_redirects, response=resp)
requests.exceptions.TooManyRedirects: Exceeded 30 redirects.

TypeError: unsupported operand type(s) for +: 'NoneType' and 'str'

Hi, in /Corsy/core/tests.py line 38, i have that error.

I tested using: python3 corsy.py -u "https://54.76.200.24"

root value is empty y think is because it is an IP.

Regards!

ModuleNotFoundError

Hi,
When i try to run the corsy.py i got following error.

Traceback (most recent call last):
  File "corsy.py", line 6, in <module>
    from core.utils import load_json, host
ModuleNotFoundError: No module named 'core.utils

Python version: Python 3.7.5

Error Parsing Headers

Python 3.9.13

python3 corsy.py -u https://mail.google.com --headers "User-Agent: GoogleBot\nCookie: SESSION=Hacked"

Traceback (most recent call last): File "/Users/USER/Tools/Corsy/corsy.py", line 47, in <module> header_dict = extractHeaders(header_dict) File "/Users/USER//Tools/Corsy/core/utils.py", line 70, in extractHeaders matches = re.findall(r'^?(.*?):\s(.*?)[\n$]', headers) File "/usr/local/Cellar/[email protected]/3.9.13_1/Frameworks/Python.framework/Versions/3.9/lib/python3.9/re.py", line 241, in findall return _compile(pattern, flags).findall(string) File "/usr/local/Cellar/[email protected]/3.9.13_1/Frameworks/Python.framework/Versions/3.9/lib/python3.9/re.py", line 304, in _compile p = sre_compile.compile(pattern, flags) File "/usr/local/Cellar/[email protected]/3.9.13_1/Frameworks/Python.framework/Versions/3.9/lib/python3.9/sre_compile.py", line 788, in compile p = sre_parse.parse(p, flags) File "/usr/local/Cellar/[email protected]/3.9.13_1/Frameworks/Python.framework/Versions/3.9/lib/python3.9/sre_parse.py", line 955, in parse p = _parse_sub(source, state, flags & SRE_FLAG_VERBOSE, 0) File "/usr/local/Cellar/[email protected]/3.9.13_1/Frameworks/Python.framework/Versions/3.9/lib/python3.9/sre_parse.py", line 444, in _parse_sub itemsappend(_parse(source, state, verbose, nested + 1, File "/usr/local/Cellar/[email protected]/3.9.13_1/Frameworks/Python.framework/Versions/3.9/lib/python3.9/sre_parse.py", line 669, in _parse raise source.error("nothing to repeat", re.error: nothing to repeat at position 1

Input with list of urls

I think add the file input option is nice when working with a list of URLs.

error: unrecognized arguments: -i

Hi @s0md3v Thanks for this amazing tool. While running, I am getting this Error:

python3 corsy.py -i /root/alive.txt

    ＣＯＲＳＹ  {v0.2-beta}

usage: corsy.py [-h] [-u URL] [-d DELAY]
corsy.py: error: unrecognized arguments: -i

Traceback (most recent call last):
  File "corsy.py", line 46, in <module>
    header_dict = extractHeaders(header_dict)
NameError: name 'extractHeaders' is not defined

The following command was used

python3 corsy.py -u https://accf1f791f8593a380326bad001f00ac.web-security-academy.net/accountDetails --headers "session=JhpVqwyzs4Q"

certificate verification

~/tools/Corsy$ python3 corsy.py -u https://DOMAIN.com/

    ＣＯＲＳＹ  {v0.2-beta}

/usr/lib/python3/dist-packages/urllib3/connectionpool.py:794: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html
  InsecureRequestWarning)
[-] No misconfiguration found.

How to configure/resolve this warning?

Python Error

File "corsy.py", line 13
SyntaxError: Non-ASCII character '\xef' in file corsy.py on line 14, but no encoding declared; see http://python.org/dev/peps/pep-0263/ for details

s0md3v / corsy Goto Github PK

corsy's Introduction

Corsy

CORS Misconfiguration Scanner

Introduction

Requirements

Usage

Scan URLs from a file

Scan URLs from stdin

Number of threads

Delay between requests

Export results to JSON

Custom HTTP headers

Skip printing tips

Tests implemented

corsy's People

Contributors

Stargazers

Watchers

Forkers

corsy's Issues

Command:

Got the following error:

Recommend Projects

Recommend Topics

Recommend Org