From beffd0b3162c9c5020f23952bd6373df43c4f469 Mon Sep 17 00:00:00 2001 From: jensvoid Date: Fri, 14 Aug 2020 21:46:07 +0200 Subject: [PATCH] It's 2020 and we're Python 3 compatible :) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 1423cc6..ac739fc 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ **Based on the research of [James Kettle](https://twitter.com/albinowax)** -CORStest is a *quick & dirty* Python 2 tool to find Cross-Origin Resource Sharing ([CORS](https://www.w3.org/TR/cors/)) misconfigurations. It takes a text file as input which may contain a list of domain names or URLs. Currently, the following potential vulnerabilities are detected by sending a certain `Origin` request header and checking for the `Access-Control-Allow-Origin` response header: +CORStest is a *quick & dirty* Python 3 tool to find Cross-Origin Resource Sharing ([CORS](https://www.w3.org/TR/cors/)) misconfigurations. It takes a text file as input which may contain a list of domain names or URLs. Currently, the following potential vulnerabilities are detected by sending a certain `Origin` request header and checking for the `Access-Control-Allow-Origin` response header: - **Developer backdoor:** Insecure dev origins like JSFiddle or CodePen are allowed to access this resource - **Origin reflection:** The origin is simply echoed in ACAO header, any site is allowed to access this resource