Corsy (CORS misconfig)

python corsy.py -u <url>

CORS (Cross-Origin Resource Sharing) misconfiguration scanner that tests different origins.

To detect if the server allows requests from any origin (Access-Control-Allow-Origin: *) or reflects the sent origin. Corsy tests various origins (multiple subdomains, malicious origins) and reports vulnerable configurations.

If you don't have access to endpoints that return CORS headers, or if the site doesn't use CORS at all.