Advanced CSP Bypass Techniques
Paste the following prompt into your AI chat to install this skill:
Please follow https://skillhub.cn/install/skillhub.md to install @user_3c6cb52e/csp-bypass-advanced-9c35.
About this skill
Problem Addressed
Many sites ship CSPs that still fail because directives such as base-uri, form-action, and frame-ancestors do not inherit from default-src, or because nonce handling, trusted CDNs, and framework templates create unexpected execution paths. This skill frames CSP review as a directive-by-directive assessment problem for security testing and defensive hardening.
How It Works and Boundaries
It organizes the analysis by script-src mode: 'self', CDN allowlists, nonce, hash, 'unsafe-eval', or 'strict-dynamic', then checks for vectors like JSONP endpoints, uploaded script resources, DOM sinks, template injection, service workers, and path confusion. It also covers exfiltration paths that may survive strict connect-src, img-src, and style-src, including DNS, WebRTC, form submission, and violation-report leakage. The skill is intended for authorized testing, research, and hardening; it is not a substitute for live validation, and any work on third-party CDNs, user content, or production systems should follow scope, authorization, and low-impact rules.
Use Cases
- During authorized penetration testing, determine whether a target's `script-src` policy allows execution via same-origin resources, JSONP endpoints, or DOM-based injection.
- Audit whether a site's CSP omits `base-uri`, `form-action`, or `frame-ancestors`, then document risks such as relative-path loading, form hijacking, or clickjacking.
- Analyze nonce usage, trusted CDN allowlists, and `'strict-dynamic'` trust propagation to identify predictable nonces or third-party script entry points.
- When `connect-src` and `img-src` are restrictive, map potential data exfiltration channels such as DNS, WebRTC, form submission, CSS requests, or violation reports.
Best For
- White-hat testers performing web application penetration tests need to break CSP policies into reproducible directive-level bypass checks.
- Backend engineers hardening front-end security need to verify before release whether CSP configuration truly blocks script execution or data exfiltration.
- SREs responsible for security assessments need to review production headers, meta CSP, nonce handling, and CDN allowlists for consistent defense.
- Researchers studying browser security mechanisms need to map edge cases around `strict-dynamic`, nonce handling, `base-uri`, and violation reports.
Related Skills
Analyzes network captures from Wireshark, tcpdump, Fiddler, and Charles, then pinpoints TCP, HTTP, DNS, and TLS issues with filter expressions and remediation steps.
Detects AI-generated images from Stable Diffusion, Midjourney, and GPT-4o via Tencent Cloud image moderation and returns risk scores.
Sets up a baseline Dynamo router, enables KV-aware routing when appropriate, and smoke tests the frontend endpoint locally or on Kubernetes.
CTF cryptography quick reference for engineers covering classic, modern, RSA, ECC, stream, PRNG, and lattice attacks.