Cross-Site Scripting

Content Security Policy and CSP Bypass

CSP is the browser's XSS firewall. Learn how it works, why it gets misconfigured, and how attackers bypass it through JSONP, open redirects, and trusted CDNs.

Advanced50 min7 lessons1 hands-on

Start free →I have an account

First lesson free. The full module is part of Pro.

You'll be able to

✓Read and interpret a Content-Security-Policy header
✓Identify common CSP misconfigurations that allow script execution
✓Bypass CSP using JSONP endpoints, unsafe-inline, and script gadgets
✓Understand why CSP is a mitigation, not a silver bullet

Lessons

1What is CSP and Why It Exists
2CSP Bypass Techniques
3Your Turn: Bypass the PolicyHANDS-ON
4Reading and Evaluating Real CSP Headers
5Mini Lab — Analysing CSP Policies for Bypass Paths
6Module quiz
7Lab 1: Hackr Terminal — Analysing and Testing a CSP

Start free →