CORS (Cross-Origin Resource Sharing)

Cross-platform resources for CORS (Cross-Origin Resource Sharing): curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice CORS (Cross-Origin Resource Sharing): retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 3 challenges across 1 platform — 3 PortSwigger. 0 with a Spanish writeup, 0 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — CORS vulnerability with basic origin reflection (Apprentice) · 🇬🇧
2. PortSwigger — CORS vulnerability with trusted null origin (Apprentice) · 🇬🇧
3. PortSwigger — CORS vulnerability with trusted insecure protocols (Practitioner) · 🇬🇧

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/cors

PortSwigger labs practicing CORS (Cross-Origin Resource Sharing) (3)

Lab	Difficulty	Topic	Official
CORS vulnerability with basic origin reflection	APPRENTICE	CORS	Open
CORS vulnerability with trusted null origin	APPRENTICE	CORS	Open
CORS vulnerability with trusted insecure protocols	PRACTITIONER	CORS	Open

---

← Back to the full glossary

Last updated: 2026-08-17