CORS withCredentials=true Admin Session Hijack via cors_exploit_poc.html

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

This rule detects suspicious web traffic patterns associated with potential Cross-Origin Resource Sharing (CORS) exploitation. It monitors for access to files containing 'cors_exploit_poc', HTTP POST requests containing sensitive 'AMAUTHID' cookies, or the presence of 'withCredentials' headers alongside 'Access-Control-Allow-Origin' configurations. These indicators, particularly when combined, suggest unauthorized attempts to bypass browser-based security models to access sensitive session identifiers or data.