Add files via upload

db/details.json

@@ -0,0 +1,48 @@
+{
+	"wildcard value" : {
+		"Description" : "This host allows requests made from any origin. However, browsers will block all requests to this host by default.",
+		"Severity" : "Low",
+		"Exploitation" : "Not possible"
+	},
+	"third party allowed" : {
+		"Description" : "This host has whitelisted a third party host for cross origin requests.",
+		"Severity" : "Medium",
+		"Exploitation" : "If the whitelisted host is a code hosting platform such as codepen.io or has an XSS vulnerbaility, it can be used to exploit this misconfiguration."
+
+	},
+	"origin reflected" : {
+		"Description" : "This host allows any origin to make requests to it.",
+		"Severity" : "High",
+		"Exploitation" : "Make requests from any domain you control."
+	},
+	"invalid value" : {
+		"Description" : "Header's value is invalid, this CORS implementation doesn't work at all.",
+		"Severity" : "Low",
+		"Exploitation" : "Not possible"
+	},
+	"post domain wildcard" : {
+		"Description" : "The origin verification is flawed, it allows requests from a host that has this host as as preffix.",
+		"Severity" : "High",
+		"Exploitation" : "Make requests from target.com.attacker.com"
+	},
+	"pre domain wildcard" : {
+		"Description" : "The origin verification is flawed, it allows requests from a host that has this host as as suffix.",
+		"Severity" : "High",
+		"Exploitation" : "Make requests from attacker-target.com"
+	},
+	"null origin allowed" : {
+		"Description" : "This host allows requests from 'null' origin.",
+		"Severity" : "High",
+		"Exploitation" : "Make requests from a sanboxed iframe."
+	},
+	"http origin allowed" : {
+		"Description" : "This host allows sharing resources over an unencrypted (HTTP) connection.",
+		"Severity" : "Low",
+		"Exploitation" : "Sniff requests made over the unencrypted channel."
+	},
+	"broken parser" : {
+		"Description" : "The origin verification is flawed and can be bypassed using a backtick (`).",
+		"Severity" : "High",
+		"Exploitation" : "Set the 'Origin' header to %60.example.com"
+	}
+}