performing-content-security-policy-bypass

name	performing-content-security-policy-bypass
description	Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives, and policy injection techniques. Use when analyzeing and bypass content security policy implementations to achieve cross-site.
domain	cybersecurity
tags	["csp-bypass","content-security-policy","xss","script-injection","nonce-bypass","jsonp","policy-misconfiguration"]
subdomain	web-application-security
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Performing Content Security Policy Bypass

Overview

Cybersecurity skill for performing content security policy bypass. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing content security policy bypass"

• "Analyze and bypass Content Security Policy implementations to achieve cross-site"

• When XSS is found but execution is blocked by Content Security Policy

• During web application security assessments to evaluate CSP effectiveness

• When testing the robustness of CSP against known bypass techniques

• During bug bounty hunting where CSP prevents direct XSS exploitation

• When auditing CSP header configuration for security weaknesses

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Burp Suite for intercepting responses and analyzing CSP headers
• CSP Evaluator (Google) for automated policy analysis
• Understanding of CSP directives (script-src, default-src, style-src, etc.)
• Knowledge of CSP bypass techniques (JSONP, base-uri, object-src)
• Browser developer tools for CSP violation monitoring
• Collection of whitelisted domain JSONP endpoints

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}