CSP and Bypasses

This blog post aims to demonstrate what CSP is and why CSP is implemented. And how attackers can bypass CSP. In this article, I will include how you can bypass some directives to achieve XSS on the target application.

XSS bypassing CSP and using DOM clobbering

ExploitWareLabs - CSP(Content Security Policy) Bypass via

Exfiltrating User's Private Data Using Google Analytics to Bypass CSP

Content Security Policy ByPass

javascript - Content Security Policy bypass - Stack Overflow

Chrome CSP bypass zero-day vulnerability – Update your browsers

How to use Google's CSP Evaluator to bypass CSP - Web Security Blog

Researcher goes public with WordPress CSP bypass hack

DVWA - CSP Bypass - Braincoke

XSS bypassing CSP and using DOM clobbering

Bypassing Your Defenses: Common CSP Bypasses

How Browser Extensions Routinely Bypass a CSP

VolgaCTF 2018 - Neatly bypassing CSP

Content Security Policy Bypass - Deteact - continuous information security services