Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
CORS
A CORS misconfiguration lets any origin read authenticated responses — your victim's browser does the work for you. The browser's same-origin policy is only as strong as the server's Origin handling; reflection is the failure mode.
Severity guide
High when credentials ride on attacker-reflected origins on data-bearing endpoints; medium for reflection without credentials; informational for misconfig without sensitive data.
Where to look
entry points to test first01
Any authenticated API endpoint
Send Origin: https://evil.com with your session cookie — inspect ACAO/ACAC headers on every response.
02
User-data endpoints
Profile, invoices, messages, tokens — the data that makes the exfil worth reporting.
03
OAuth/token endpoints
Token refresh and exchange flows — CORS here chains into account takeover.
04
Subdomain-influencing features
Takeover-able subdomains or user content on subdomains — origin matchers that trust *.domain leak to them.
05
JSONP leftovers
?callback= endpoints are the pre-CORS ancestor — same impact, easier exploit.
How to hunt it
in order, start to finishSend an evil Origin
Origin: https://evil.com on a data-bearing endpoint. Access-Control-Allow-Origin echoing it back with Access-Control-Allow-Credentials: true is the jackpot.
Test origin parsing bugs
Prefix/suffix tricks (evilexample.com), null origin (sandboxed iframe), subdomain takeover chaining — naive matchers leak to them.
Remember the limits
* (wildcard) can't be combined with credentials — only exact-origin reflection with credentials:true is exploitable.
Build the exploit page
fetch with credentials:'include' from the evil origin, exfiltrate the JSON — host it and the report writes itself.
Filter & validation bypasses
when your first tries get blocked- 01Exact match enforced? Check prefix/suffix matching bugs (evil-example.com vs example.com) and '.' placement rules.
- 02Subdomain allow-list? Take over a discarded subdomain or find user-content subdomains — they pass the matcher.
- 03null origin accepted? Sandboxed iframes send Origin: null — some servers whitelist it.
- 04Reflection only without credentials? Look for token-bearing endpoints that don't need cookies (API keys in headers you can set).
Impact ladder
what makes it payable- 01Cross-origin data theft — read any authenticated response as the victim.
- 02Account takeover chains — steal tokens/CSRF via CORS, then act as the user.
- 03PII exposure at scale — one request per victim, no interaction beyond a page visit.
- 04Chains with XSS/JSONP into full session compromise.
Payloads
4 · from PayloadsAllTheThingsOrigin: https://evil.comThe first test — reflection of any attacker origin means broken validation.
https://trusted-origin.example.com/?xss=<script>CORS-ATTACK-PAYLOAD</script>Origin derived from an attacker-controlled subdomain/query — chains past allow-lists.
https://*.example.com is not validWildcard subdomain origins don't exist in CORS — servers 'supporting' them do it by flawed string matching.
* is the only wildcard originSpec fact that anchors every CORS report — credentials can't ride on *.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.