csp-bypass-advanced

A security-testing playbook for advanced Content Security Policy (CSP) bypass techniques, used when XSS or data exfiltration is blocked by CSP and the tester needs to find policy weaknesses, abuse trusted endpoints, leak nonces, or locate exfiltration channels CSP cannot block. It emphasizes checking what the policy actually contains before choosing an approach, rather than assuming an unsafe-inline bypass or overlooking gaps like base-uri and object-src.

A directive reference matrix explains what each directive controls and its fallback behavior, highlighting the critical insight that base-uri, form-action, and frame-ancestors do not fall back to default-src, so their absence is always a potential bypass vector. Bypass techniques are organized by directive: for a self-only script-src, vectors include JSONP endpoints, uploaded JS files, DOM XSS sinks, framework template injection, service workers, and path confusion; for CDN whitelists, hosting attacker code on trusted CDNs such as jsdelivr, unpkg, cdnjs, googleapis, or shared cloudfront; for unsafe-eval, template-injection gadgets; for nonces, reuse, CRLF injection, dangling-markup nonce theft, DOM clobbering, and script gadgets; and for strict-dynamic, base-uri injection and trusted script gadgets. It also covers framework-specific bypasses for Angular and Vue, and abuse of missing object-src, base-uri, and frame-ancestors.

Additional material contrasts CSP delivered via meta tag versus HTTP header, noting meta-tag limitations (it cannot set frame-ancestors, report-uri/report-to, or sandbox) and injection-ordering nuances. Related routing connects to XSS delivery, dangling-markup injection for exfiltration without JavaScript, CRLF injection for header or nonce manipulation, WAF bypass, and clickjacking when frame-ancestors is absent. As offensive tooling, it is intended for authorized testing of applications whose CSP is meant to contain XSS or exfiltration.