> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/hacking-tools/exploitation/csp-bypass.md).

# CSP Bypass

CSP Bypass is a research resource for reviewing Content Security Policy weaknesses, risky allowlists, and browser-specific behavior during authorized testing.

[CSP Bypass](https://cspbypass.com/) collects research for evaluating Content Security Policy controls. Use it to validate policies in systems you own or are authorized to test.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2F9jMcNmkKNQCChy8feUL9%2Fimage.png?alt=media&amp;token=6bce4466-7795-4ce4-8319-d2c1e4b4e8bb" alt=""><figcaption></figcaption></figure>

### What to review

* Capture every `Content-Security-Policy` header and policy `meta` tag.
* Review `script-src`, `object-src`, `base-uri`, and `frame-ancestors` first.
* Record nonces, hashes, `strict-dynamic`, wildcards, and third-party sources.

### Validation workflow

1. Capture the policy using browser developer tools or an intercepting proxy.
2. Identify the injection point and its available execution context.
3. Check allowed sources against CSP Bypass research and browser behavior.
4. Use the smallest controlled proof that demonstrates the policy weakness.
5. Document the policy, browser version, prerequisite, and observed impact.

### High-risk policy patterns

| Pattern                 | Why it matters                                                                |
| ----------------------- | ----------------------------------------------------------------------------- |
| `script-src *`          | Any HTTPS script origin may become executable.                                |
| `'unsafe-inline'`       | Inline script injection can bypass the intended restriction.                  |
| Broad wildcards         | Subdomain takeovers or forgotten hosts can create execution paths.            |
| Stale third-party hosts | A trusted origin may expose JSONP, redirects, or attacker-controlled content. |
| Missing `object-src`    | Legacy plugin content may remain permitted.                                   |

### Hardening baseline

Use a strict policy as a starting point. Adapt source lists to application requirements.

```http
Content-Security-Policy: default-src 'none'; script-src 'nonce-<random-per-response>' 'strict-dynamic'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'
```

* Generate a unique nonce for every response.
* Remove unused third-party script sources.
* Deploy policy changes in report-only mode before enforcement.

### Reporting checklist

Include the affected URL, full policy, and vulnerable directive. Describe the required injection primitive and tested browser. State the minimum reproducible impact. Recommend the narrowest policy change that closes the issue.

### References

* [CSP Bypass](https://cspbypass.com/)
* [MDN: Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)
* [CSP Evaluator](https://csp-evaluator.withgoogle.com/)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/hacking-tools/exploitation/csp-bypass.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.