vulnbeacon_TOOLS
← All tools

Web & TLS

CORS inspector

Compare same-origin, untrusted and null-origin GET responses. You can add one fixed OPTIONS preflight; no PUT request, credentials or request body is sent.

How to use CORS inspectorSteps, privacy & next steps

Compare cross-origin response policies using controlled, uncredentialed probes.

Run this check

  1. Enter the exact public URL and confirm permission.
  2. Leave preflight off for the three GET probes, or explicitly include the fixed OPTIONS diagnostic.
  3. Review same-origin, untrusted and null-origin responses against your intended browser clients.

What you need

  • An approved public HTTP(S) endpoint. Optional preflight advertises PUT and content-type only.

Your input & privacy

The target receives three bounded GETs and, only when selected, one fixed OPTIONS request. Results are temporary.

Read the result

Compare the sampled policies and Vary behavior. Validate intended and rejected requests in an authorized browser workflow before changing CORS.

Keep in mind

  • No PUT, request body, credentials or browser exploit is sent.
  • Reflected origins can be intentional on public endpoints. Policy observations do not prove access to private data.

Your inputs, explained.

JWTs, source snippets, passwords, CSP text, files, hashes and Base64 are processed in browser memory. This toolkit does not upload or save those inputs.

Website checks send the approved URL to this service and contact the target. DNS checks disclose the domain to Cloudflare DNS over HTTPS. Email-breach checks send the full address to Have I Been Pwned when configured and explicitly requested.

Server checks are transient and rate limited. This application does not write tool input or result logs; your hosting provider and contacted services may retain network metadata under their own policies. Exports are saved only when you choose to download them.

Use tools only for assets you own or have permission to assess. Private scans and their saved reports use the separate authenticated VulnBeacon application.