Exploiting CORS misconfigurations for Bitcoins and bounties

James Kettle shows how to examine and exploit misconfigured CORS from a hacker's perspective, covering origin reflection, wildcards and credential pitfalls. Condensed from his AppSec USA talk.