<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-csp-bypass-testing
description: >-
  Evaluate Content Security Policy implementations for bypass
  vulnerabilities including unsafe-inline, unsafe-eval, wildcard sources,
  JSONP endpoint abuse, base-uri hijacking, and trusted CDN gadgets
  that enable XSS despite CSP enforcement.
domain: cybersecurity
subdomain: application-security
tags:
  - csp
  - content-security-policy
  - xss-bypass
  - browser-security
  - owasp-a03
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059.007", "T1189"]
  owasp-top10: ["A03"]
  tools: ["curl", "burpsuite", "csp-evaluator", "nuclei"]
---

# Performing CSP Bypass Testing

## Overview

Content Security Policy is a defense-in-depth mechanism against XSS, but
misconfigurations are common. Bypasses exploit unsafe-inline, unsafe-eval,
overly permissive whitelists, JSONP endpoints on trusted domains, missing
directives, and base-uri hijacking to execute attacker-controlled scripts.

## Prerequisites

- Tools: curl, Burp Suite, Google CSP Evaluator, nuclei
- Target with CSP headers or meta tags
- Browser developer tools

## Workflow

### Step 1: Extract and Analyze CSP

```bash
# Extract CSP header
curl -s -D- https://target.com/ | grep -i 'content-security-policy'

# Parse CSP directives
curl -s -D- https://target.com/ | grep -i 'content-security-policy' | \
  tr ';' '\n' | sed 's/^ //'
```

### Step 2: Check for Common Weaknesses

```bash
# Check for unsafe-inline and unsafe-eval
curl -s -D- https://target.com/ | grep -i content-security-policy | \
  grep -oE "(unsafe-inline|unsafe-eval|unsafe-hashes|data:|blob:)"

# Check for wildcard sources
curl -s -D- https://target.com/ | grep -i content-security-policy | \
  grep -oE '\*\.[a-z]+|\*'

# Nuclei CSP analysis
nuclei -u https://target.com -t http/misconfiguration/csp/ -json
```

### Step 3: JSONP and CDN Gadget Bypass

```bash
# Find JSONP endpoints on whitelisted domains
# If CSP allows *.googleapis.com:
curl -s "https://accounts.google.com/o/oauth2/revoke?callback=alert(1)"

# Check for JSONP on whitelisted origins
curl -s "https://whitelisted-domain.com/api?callback=alert" | head -5
```

### Step 4: base-uri and form-action Bypass

```bash
# Check if base-uri is restricted
curl -s -D- https://target.com/ | grep -i content-security-policy | \
  grep -o 'base-uri[^;]*'

# Check form-action restriction
curl -s -D- https://target.com/ | grep -i content-security-policy | \
  grep -o 'form-action[^;]*'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| CSP report-uri violations | CSP reports | Blocked inline scripts indicate XSS attempts |
| JSONP callback abuse | API logs | Unusual callback parameter values |
| base tag injection | WAF logs | HTML injection containing base elements |

```yaml
title: Csp Bypass Testing Detection
id: b7af21ff-ddba-4b84-8dbc-caa7a5a71bdb
status: experimental
description: Detects suspicious activity related to performing csp bypass testing techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1059.007
  - attack.t1189
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] CSP header extracted and all directives analyzed
- [ ] unsafe-inline and unsafe-eval usage documented
- [ ] Whitelisted domains checked for JSONP/gadget endpoints
- [ ] base-uri and form-action directives verified
- [ ] Report-uri or report-to configured for monitoring
- [ ] Nonce or hash-based CSP preferred over whitelist

## References

- [Google CSP Evaluator](https://csp-evaluator.withgoogle.com/)
- [CSP Bypass Techniques](https://book.hacktricks.xyz/pentesting-web/content-security-policy-csp-bypass)
- [PortSwigger CSP Bypass](https://portswigger.net/web-security/cross-site-scripting/content-security-policy)
