CSP and Bypasses

This blog post aims to demonstrate what CSP is and why CSP is implemented. And how attackers can bypass CSP. In this article, I will include how you can bypass some directives to achieve XSS on the target application.

GitHub - buffermet/CSP-bypass: Bypass Content-Security-Policy to phish data.

CSP Bypass using Polyglot File Demo

CSP Bypass: Common Techniques and Mitigations

GitHub - PortSwigger/csp-bypass: A Burp Plugin for Detecting Weaknesses in Content Security Policies

CSP and Bypasses

Browser monitor issues with Content Security Policy - Dynatrace Docs

CSP-bypass XSS in project settings page (#364164) · Issues · GitLab.org / GitLab · GitLab

Content Security Policy Bypass - Deteact - continuous information security services

CSP Bypass via old jQuery - Thanks parseHTML!

Bypassing CSP via ajax.googleapis.com