Testing CORS Misconfiguration When to Use - During authorized penetration tests when assessing API endpoints for cross-origin access controls - When testing single-page applications that make cross-origin API requests - For evaluating whether sensitive data can be exfiltrated from a victim's browser session - When assessing microservice architectures with multiple domains sharing data - During security audits of applications using CORS headers for cross-domain communication Prerequisites - Authorization : Written penetration testing agreement for the target - Burp Suite Professional : For int…