Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Content Security Policy (CSP) is a security mechanism that helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks. CSP defines which sources of content are allowed to be loaded and executed by the browser. This test evaluates whether CSP is implemented correctly and identifies misconfigurations that could allow attackers to bypass the policy.
# If whitelisted domain has JSONP# Policy: script-src 'self' https://trusted.com# Test JSONP callback
curl -s "https://trusted.com/api?callback=alert(1)"# If callback is reflected, CSP can be bypassed
2. Check for Angular/Template Injection
<!-- If Angular is loaded and unsafe-eval not blocked --><divng-appng-csp>{{constructor.constructor('alert(1)')()}}</div>
3. Check for Base URI Injection
<!-- If base-uri not set --><basehref="https://attacker.com/" /><scriptsrc="/malicious.js"></script>
Step 4: Browser DevTools Analysis
Open DevTools (F12)
Go to Console tab
Look for CSP violation reports
Network tab > filter by "report" for CSP reports
Step 5: CSP Evaluator Tools
# Google CSP Evaluator (online)# https://csp-evaluator.withgoogle.com/# Local analysis with csp-evaluator
npm install -g csp-evaluator
csp-evaluator "script-src 'self' 'unsafe-inline'"
Tools
Online Tools
Tool
URL
Purpose
Google CSP Evaluator
csp-evaluator.withgoogle.com
Policy analysis
CSP Validator
cspvalidator.org
Validation
Security Headers
securityheaders.com
Header check
Mozilla Observatory
observatory.mozilla.org
Security scan
Browser Extensions
Extension
Browser
Purpose
CSP Evaluator
Chrome
Inline analysis
CSP Tester
Firefox
Policy testing
Burp Extensions
Extension
Purpose
CSP Auditor
CSP analysis
CSP Bypass
Bypass detection
Example Commands/Payloads
Comprehensive CSP Analyzer
#!/bin/bash
TARGET=$1echo"=== CSP SECURITY ANALYSIS ==="echo"Target: $TARGET"echo""# Get CSP header
csp_header=$(curl -sI "https://$TARGET" | grep -i "^content-security-policy:" | cut -d: -f2-)
csp_ro=$(curl -sI "https://$TARGET" | grep -i "^content-security-policy-report-only:" | cut -d: -f2-)
# Get CSP meta tag
csp_meta=$(curl -s "https://$TARGET" | grep -oP '(?<=<meta http-equiv="Content-Security-Policy" content=")[^"]+')
if [ -z "$csp_header" ] && [ -z "$csp_meta" ]; thenecho"[CRITICAL] No CSP implemented!"exit 1
fi
csp="${csp_header:-$csp_meta}"echo"Policy found: ${csp:0:100}..."echo""# Analysisecho"[+] Directive Analysis:"# Script-src
script_src=$(echo"$csp" | grep -oP "script-src[^;]*")
if [ -z "$script_src" ]; thenecho" script-src: Not defined (falls back to default-src)"elseecho" script-src: $script_src"ifecho"$script_src" | grep -q "unsafe-inline"; thenecho" [!] RISK: unsafe-inline allows XSS"fiifecho"$script_src" | grep -q "unsafe-eval"; thenecho" [!] RISK: unsafe-eval allows code execution"fifi# Default-src
default_src=$(echo"$csp" | grep -oP "default-src[^;]*")
echo" default-src: ${default_src:-Not defined}"# Frame-ancestors
frame_ancestors=$(echo"$csp" | grep -oP "frame-ancestors[^;]*")
if [ -z "$frame_ancestors" ]; thenecho" frame-ancestors: [!] MISSING - Clickjacking possible"elseecho" frame-ancestors: $frame_ancestors"fi# Object-src
object_src=$(echo"$csp" | grep -oP "object-src[^;]*")
if [ -z "$object_src" ]; thenecho" object-src: [!] MISSING - Plugin attacks possible"elseecho" object-src: $object_src"fi# Base-uri
base_uri=$(echo"$csp" | grep -oP "base-uri[^;]*")
if [ -z "$base_uri" ]; thenecho" base-uri: [!] MISSING - Base tag injection possible"elseecho" base-uri: $base_uri"fiecho""echo"[+] Use Google CSP Evaluator for detailed analysis:"echo" https://csp-evaluator.withgoogle.com/"
CSP Bypass Test Payloads
<!-- Test for unsafe-inline bypass --><script>alert("XSS")
</script><!-- Test for event handler bypass --><imgsrc="x"onerror="alert('XSS')" /><!-- Test for data: URI --><scriptsrc="data:text/javascript,alert('XSS')"></script><!-- Test for JSONP bypass --><scriptsrc="https://whitelisted.com/jsonp?callback=alert"></script><!-- Angular sandbox bypass (old versions) -->
{{constructor.constructor('alert(1)')()}}
