⚠️ AUTHORIZED USE ONLY. CORSair is for authorized penetration testing, bug bounty research within defined program scope, and security education only. Use only against systems you own or have explicit written permission to test. Unauthorized probing violates CFAA (US), Computer Misuse Act (UK), IT Act 2000 (India), and equivalent laws worldwide. The author bears zero liability for misuse.
CORSair
Cross-Origin Request Security Analysis & Intelligence Reporter
v3.0.0 📤 TELEGRAM 🔐 PERSONAL BUILD By Pratik Khairnar
🔑 Auth Preset
withCredentials ON
Auto Preflight
Timeout sec
Your Origin: 
Awaiting probe…
No response yet — run a probe.
🔬
No Analysis Yet
Run a probe — CORS analysis appears here automatically.
PENDING
Run a probe first — PoC is generated automatically after a successful request.
✈️
Telegram Integration
Send your CORS findings, PoC files, and bug report directly to your Telegram — instantly, without leaving the tool.

⚙️ Setup (one-time, 2 minutes)

1
Open Telegram → search @BotFather → send /newbot → follow prompts → copy the Bot Token it gives you
2
Search @userinfobot on Telegram → send any message → it replies with your numeric Chat ID (e.g. 123456789). For a group, add the bot to the group first, then send a message.
3
Paste both below → click Test Connection → then Send to Telegram after any probe.

🔑 Bot Credentials

📦 What Gets Sent to Telegram
  • Summary message: severity, target URL, CORS headers, verdict, timestamp
  • HTML PoC file as document attachment (filename = target domain)
  • Exfil PoC file (if webhook URL is configured)
  • Bug report as Markdown document
  • HTML Report as downloadable document
Telegram Log
Waiting for action…
⚡ Batch URL Scanner — Up to 50 endpoints
READABLE = response accessible cross-origin = potential misconfiguration. BLOCKED = CORS properly configured from your current origin (use Bypass Matrix to test from other origins via cURL).
withCredentials
Timeout/req sec
No requests in this session yet.