CORS-vulnerability-with-basic-origin-reflection

This repository presents a proof-of-concept for exploiting a CORS (Cross-Origin Resource Sharing) vulnerability characterized by a misconfigured policy that allows arbitrary `Origin` headers and sets `Access-Control-Allow-Credentials: true`. The primary use case involves demonstrating how such vulnerabilities can be detected and exploited to exfiltrate sensitive data, such as an API key, from a victim's browser. Notable features include detailed steps for testing the vulnerability using tools like Burp Suite and a lab walkthrough that guides users through the detection and exploitation processes.