sorx 0.1.0__tar.gz

sorx-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 _unkn?wn
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

sorx-0.1.0/MANIFEST.in

@@ -0,0 +1 @@
+recursive-include src/sorx *.yaml

sorx-0.1.0/PKG-INFO

@@ -0,0 +1,171 @@
+Metadata-Version: 2.4
+Name: sorx
+Version: 0.1.0
+Summary: A tool for analyzing CORS headers
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: PyYAML>=6.0
+Requires-Dist: requests>=2.32
+Requires-Dist: colorama>=0.4.6
+Dynamic: license-file
+
+# sorx
+
+> A lightweight CORS security analyzer for bug bounty hunters.
+
+`sorx` is a CLI tool for analyzing CORS configurations and detecting potentially security-relevant misconfigurations with a focus on **low noise and useful findings**.
+
+> [!NOTE]
+> **sorx is currently under active development.**
+> 
+> The project is not ready for use yet. The main executable/CLI is not available at this time, and functionality is still being implemented.
+
+## Features
+
+- CORS misconfiguration detection
+- Active origin fuzzing
+- Credential & origin reflection checks
+- Sensitive header analysis
+- HTTP method analysis
+- CORS combination checks
+- Configurable timeout, rate limit & threads
+- JSON output
+- Low-noise findings
+
+## Why sorx?
+
+- **CLI-first** — Designed to fit naturally into recon and bug bounty pipelines.
+- **Free & open source** — Free to use, inspect, modify, and contribute to.
+- **Actively developed** — Continuously improved with new checks, payloads, and features.
+- **Low noise** — Focuses on security-relevant CORS behavior instead of reporting every configuration.
+- **Automation-friendly** — Supports JSON output and configurable threads, rate limits, and timeouts.
+- **Lightweight** — Simple setup with minimal dependencies.
+- **Built for hunters and testers** — Designed around practical CORS testing workflows rather than generic HTTP scanning.
+
+## Installation
+
+### pip
+
+Install:
+
+```
+pip install sorx
+```
+
+Update:
+
+```
+pip install -U sorx
+```
+
+### pipx
+
+Install:
+
+```
+pipx install sorx
+```
+
+Update:
+
+```
+pipx upgrade sorx
+```
+
+### From Github
+
+Install directly from GitHub:
+
+```
+pip install git+https://github.com/Pupsix/sorx.git
+```
+
+Or with `pipx`:
+
+```
+pipx install git+https://github.com/Pupsix/sorx.git
+```
+
+### From Source
+
+Clone the repository:
+
+```
+git clone https://github.com/Pupsix/sorx.git
+cd sorx
+```
+
+Create a virtual environment:
+
+```
+python3 -m venv .venv
+source .venv/bin/activate
+```
+
+Install in editable mode:
+
+```
+pip install -e .
+```
+
+The editable installation allows changes to the source code to be reflected immediately without reinstalling the package.
+
+> **Recommended:** Use `pip` or `pipx` for installation.  
+> Installing from source is intended for development.
+
+## Usage
+
+Basic scan:
+
+```
+sorx -u https://example.com
+```
+
+Enable active CORS fuzzing:
+
+```
+sorx -u https://example.com -a
+```
+
+Select testing mode:
+
+```
+sorx -u https://example.com -m quick
+```
+
+```
+sorx -u https://example.com -m normal
+```
+
+```
+sorx -u https://example.com -m deep
+```
+
+For all available options:
+
+```
+sorx --help
+```
+
+## Responsible Use
+
+`sorx` is intended for authorized security testing, including:
+
+- Bug bounty programs
+- Penetration testing
+- Security research
+- Applications you own
+
+Only test targets where you have permission to perform security testing.
+
+Do not use active fuzzing against unauthorized systems.
+
+## Status
+
+`sorx` is currently under development.
+
+The project focuses on useful findings rather than the number of checks. Some CORS configurations may be unusual without being vulnerabilities, so sorx attempts to prioritize security-relevant behavior and reduce unnecessary noise.
+
+## License
+
+MIT License

sorx-0.1.0/README.md

@@ -0,0 +1,160 @@
+# sorx
+
+> A lightweight CORS security analyzer for bug bounty hunters.
+
+`sorx` is a CLI tool for analyzing CORS configurations and detecting potentially security-relevant misconfigurations with a focus on **low noise and useful findings**.
+
+> [!NOTE]
+> **sorx is currently under active development.**
+> 
+> The project is not ready for use yet. The main executable/CLI is not available at this time, and functionality is still being implemented.
+
+## Features
+
+- CORS misconfiguration detection
+- Active origin fuzzing
+- Credential & origin reflection checks
+- Sensitive header analysis
+- HTTP method analysis
+- CORS combination checks
+- Configurable timeout, rate limit & threads
+- JSON output
+- Low-noise findings
+
+## Why sorx?
+
+- **CLI-first** — Designed to fit naturally into recon and bug bounty pipelines.
+- **Free & open source** — Free to use, inspect, modify, and contribute to.
+- **Actively developed** — Continuously improved with new checks, payloads, and features.
+- **Low noise** — Focuses on security-relevant CORS behavior instead of reporting every configuration.
+- **Automation-friendly** — Supports JSON output and configurable threads, rate limits, and timeouts.
+- **Lightweight** — Simple setup with minimal dependencies.
+- **Built for hunters and testers** — Designed around practical CORS testing workflows rather than generic HTTP scanning.
+
+## Installation
+
+### pip
+
+Install:
+
+```
+pip install sorx
+```
+
+Update:
+
+```
+pip install -U sorx
+```
+
+### pipx
+
+Install:
+
+```
+pipx install sorx
+```
+
+Update:
+
+```
+pipx upgrade sorx
+```
+
+### From Github
+
+Install directly from GitHub:
+
+```
+pip install git+https://github.com/Pupsix/sorx.git
+```
+
+Or with `pipx`:
+
+```
+pipx install git+https://github.com/Pupsix/sorx.git
+```
+
+### From Source
+
+Clone the repository:
+
+```
+git clone https://github.com/Pupsix/sorx.git
+cd sorx
+```
+
+Create a virtual environment:
+
+```
+python3 -m venv .venv
+source .venv/bin/activate
+```
+
+Install in editable mode:
+
+```
+pip install -e .
+```
+
+The editable installation allows changes to the source code to be reflected immediately without reinstalling the package.
+
+> **Recommended:** Use `pip` or `pipx` for installation.  
+> Installing from source is intended for development.
+
+## Usage
+
+Basic scan:
+
+```
+sorx -u https://example.com
+```
+
+Enable active CORS fuzzing:
+
+```
+sorx -u https://example.com -a
+```
+
+Select testing mode:
+
+```
+sorx -u https://example.com -m quick
+```
+
+```
+sorx -u https://example.com -m normal
+```
+
+```
+sorx -u https://example.com -m deep
+```
+
+For all available options:
+
+```
+sorx --help
+```
+
+## Responsible Use
+
+`sorx` is intended for authorized security testing, including:
+
+- Bug bounty programs
+- Penetration testing
+- Security research
+- Applications you own
+
+Only test targets where you have permission to perform security testing.
+
+Do not use active fuzzing against unauthorized systems.
+
+## Status
+
+`sorx` is currently under development.
+
+The project focuses on useful findings rather than the number of checks. Some CORS configurations may be unusual without being vulnerabilities, so sorx attempts to prioritize security-relevant behavior and reduce unnecessary noise.
+
+## License
+
+MIT License

sorx-0.1.0/pyproject.toml

@@ -0,0 +1,20 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "sorx"
+version = "0.1.0"
+description = "A tool for analyzing CORS headers"
+readme = "README.md"
+dependencies = [
+    "PyYAML>=6.0",
+    "requests>=2.32",
+    "colorama>=0.4.6",
+]
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[project.scripts]
+sorx = "sorx.main:main"

sorx-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

sorx-0.1.0/src/sorx/__init__.py

@@ -0,0 +1,3 @@
+from importlib.metadata import version
+
+__version__ = version("sorx")

sorx-0.1.0/src/sorx/checks/cors.py

@@ -0,0 +1,147 @@
+import time
+
+from sorx.checks.cors_analyze import analyze
+from sorx.core.display import header
+from sorx.core.requester import run as requester_run
+from sorx.data.loader.payload import load_payload
+
+
+class Stat:
+    def __init__(self, targets, mode, threads, config):
+        self.targets_list, self.targets = list(targets), len(targets)
+        self.mode, self.threads = mode, threads
+        self.header = config.get("headers", {})
+        self.scanned = 0
+        self.findings = {url: [] for url in targets}
+        self.errors = {url: [] for url in targets}
+        self.start_time = time.time()
+        self.error = self.request = 0
+        self.elapsed = "00:00"
+        self.output = config.get("output") or "None"
+
+
+def create_job(url, method="GET", headers=None, data=None, timeout=10, origin=None):
+    return {
+        "url": url,
+        "method": method,
+        "headers": headers or {},
+        "data": data,
+        "timeout": timeout,
+        "origin": origin or "",
+    }
+
+
+def get_payloads(name, mode):
+    payloads = load_payload(name).get(name, {})
+    priority_map = {
+        "quick": ["high_priority"],
+        "normal": ["high_priority", "medium_priority"],
+        "deep": ["high_priority", "medium_priority", "low_priority"],
+    }
+    result = []
+    for priority in priority_map.get(mode, []):
+        result.extend(payloads.get(priority, []))
+    return result
+
+
+def passive(url, config):
+    return [
+        create_job(
+            url=url,
+            method=config.get("method", "GET"),
+            headers=config.get("headers", {}),
+            data=config.get("data"),
+            timeout=config.get("timeout", 10),
+        )
+    ]
+
+
+def active(url, config):
+    mode, timeout, base_headers = config.get("mode"), config.get("timeout", 10), config.get("headers", {})
+    jobs = []
+
+    # Origin fuzzing
+    for origin in get_payloads("origin", mode):
+        jobs.append(create_job(url=url, method="GET", headers={**base_headers, "Origin": origin}, timeout=timeout, origin=origin))
+
+    # Preflight
+    jobs.append(
+        create_job(
+            url=url,
+            method="OPTIONS",
+            headers={
+                **base_headers,
+                "Origin": "https://attacker.example",
+                "Access-Control-Request-Method": "POST",
+                "Access-Control-Request-Headers": "Authorization",
+            },
+            timeout=timeout,
+            origin="https://attacker.example",
+        )
+    )
+
+    return jobs
+
+
+def update_elapsed(stat):
+    elapsed = time.time() - stat.start_time
+    stat.elapsed = f"{int(elapsed // 60):02d}:{int(elapsed % 60):02d}"
+
+
+def analyze_results(stat, results):
+    for result in results:
+        task = result.get("task")
+        if not task:
+            continue
+
+        target_url = task.get("url")
+        if target_url not in stat.findings:
+            continue
+
+        error = result.get("error")
+        if error is not None:
+            stat.error += 1
+            if error not in stat.errors[target_url]:
+                stat.errors[target_url].append(error)
+            continue
+
+        response = result.get("response")
+        if response is None:
+            continue
+
+        for finding in analyze(response=response, task=task):
+            if finding not in stat.findings[target_url]:
+                stat.findings[target_url].append(finding)
+
+
+def run(urls, config, on_target_done=None):
+    mode = config.get("mode")
+    mode_name = "passive" if mode is None else mode
+    workers = config.get("workers", 10)
+
+    urls = [urls] if isinstance(urls, str) else list(urls)
+    stat = Stat(targets=urls, mode=mode_name, threads=workers, config=config)
+
+    header(stat)
+
+    for url in urls:
+        # Build jobs
+        jobs = passive(url=url, config=config) if mode is None else active(url=url, config=config)
+
+        # Count requests
+        stat.request += len(jobs)
+
+        # Send requests & Analyze responses
+        results = requester_run(jobs=jobs, workers=workers)
+        analyze_results(stat=stat, results=results)
+
+        # Target finished
+        stat.scanned += 1
+        update_elapsed(stat)
+
+        # Tell caller that this target is finished
+        if on_target_done:
+            on_target_done(url, stat.findings[url], stat.errors[url])
+
+    update_elapsed(stat)
+    return stat

sorx-0.1.0/src/sorx/checks/cors_analyze.py

@@ -0,0 +1,80 @@
+from sorx.data.loader.template import load_template
+
+
+def analyze(response, task):
+    findings = []
+
+    # Load templates
+    header_template = load_template("sensitive_headers")
+    method_template = load_template("sensitive_method")
+
+    # Response headers & normalization
+    headers = response.headers
+    allow_origin = headers.get("Access-Control-Allow-Origin", "").strip().lower()
+    allow_credentials = headers.get("Access-Control-Allow-Credentials", "").strip().lower()
+    attacker_origin = (task.get("origin") or "").strip().lower()
+
+    # Parse headers and methods into sets
+    parse_csv = lambda val, case_fn: {case_fn(x.strip()) for x in val.split(",") if x.strip()} if val else set()
+    allowed_headers = parse_csv(headers.get("Access-Control-Allow-Headers", ""), str.lower)
+    allowed_methods = parse_csv(headers.get("Access-Control-Allow-Methods", ""), str.upper)
+    exposed_headers = parse_csv(headers.get("Access-Control-Expose-Headers", ""), str.lower)
+
+    # Sensitive lookup sets
+    sensitive_request_headers = {h.lower() for h in header_template["sensitive_request_headers"]}
+    sensitive_response_headers = {h.lower() for h in header_template["sensitive_response_headers"]}
+    sensitive_methods = {m.upper() for m in method_template["sensitive_methods"]}
+
+    # Basic check flags
+    wildcard_origin = allow_origin == "*"
+    origin_reflection = bool(attacker_origin and allow_origin == attacker_origin)
+    null_origin = allow_origin == "null"
+    credentials = allow_credentials == "true"
+
+    # Rule checks
+    if wildcard_origin:
+        findings.append(("CORS-001", "Wildcard origin"))
+
+    if origin_reflection:
+        findings.append(
+            ("CORS-101", "Attacker origin reflected with credentials")
+            if credentials
+            else ("CORS-100", "Attacker origin reflected")
+        )
+
+    if null_origin:
+        findings.append(
+            ("CORS-200", "Null origin with credentials")
+            if credentials
+            else ("CORS-201", "Null origin allowed")
+        )
+
+    # Header & Method checks
+    found_sensitive_request_header = bool(allowed_headers & sensitive_request_headers)
+    if found_sensitive_request_header:
+        findings.append(("CORS-300", "Sensitive request header allowed"))
+
+    if "*" in allowed_headers:
+        findings.append(("CORS-301", "Wildcard request headers"))
+
+    if "*" in allowed_methods:
+        findings.append(("CORS-302", "Wildcard request methods"))
+
+    found_sensitive_response_header = bool(exposed_headers & sensitive_response_headers)
+    if found_sensitive_response_header:
+        findings.append(("CORS-400", "Sensitive response header exposed"))
+
+    found_sensitive_method = bool(allowed_methods & sensitive_methods)
+
+    # Advanced correlation rules
+    if origin_reflection and credentials:
+        if "authorization" in allowed_headers:
+            findings.append(("CORS-900", "Origin reflection with credentials and Authorization"))
+
+        if found_sensitive_request_header or found_sensitive_response_header:
+            findings.append(("CORS-901", "Origin reflection with credentials and sensitive headers"))
+
+        if "*" in allowed_methods or found_sensitive_method:
+            findings.append(("CORS-902", "Origin reflection with credentials and broad methods"))
+
+    return findings