csp-bypass-tester

CSP Bypass Tester

Inspect and test Content Security Policy implementations. Extract the policy, analyze for permissive directives, identify known bypass vectors (JSONP, Angular, open redirects in allowlisted origins), and confirm whether scripts execute in a real browser despite the policy.

Workflow

Phase 1: Recon

1. Mount skill files:

   Read plugins/pentest/skills/common-appsec-patterns/SKILL.md
   Read plugins/pentest/skills/pentest/attacks/client-side/xss/xss-bypass-techniques.md
   

2. Extract CSP header using curl:

   curl -sI https://TARGET/ 2>&1 \
     | grep -i 'content-security-policy' \
     | tee outputs/ENGAGEMENT/activity/csp-header-TARGET.txt
   

3. Also check for CSP delivered via meta tag:

   curl -s https://TARGET/ 2>&1 \
     | grep -i 'content-security-policy' \
     | tee outputs/ENGAGEMENT/activity/csp-meta-TARGET.txt
   

4. Navigate to target in browser to capture full CSP including dynamically set headers:

   browser_navigate(url="https://TARGET")
   browser_network_requests()
   

   Identify the content-security-policy header value from the network requests output.
5. Parse the CSP manually for each directive:
   • default-src: catch-all for unspecified resource types
   • script-src: controls JavaScript execution — most critical directive
   • style-src: CSS sources
   • img-src: image sources
   • connect-src: fetch/XHR/WebSocket origins
   • frame-src/child-src: iframe allowed origins
   • report-uri/report-to: reporting endpoints
6. Flag immediately dangerous directive values:
   • 'unsafe-inline' in script-src → inline scripts permitted (major weakness)
   • 'unsafe-eval' in script-src → eval() permitted (major weakness)
   • * wildcard in script-src → any origin permitted (complete bypass)
   • data: in script-src → data URI scripts permitted (known bypass)
   • http: scheme in script-src → allows any HTTP domain
   • blob: in script-src → allows blob URI execution
7. Log:

   {"timestamp":"...","agent":"csp-bypass-tester","action":"recon","target":"https://TARGET","csp_present":true,"script_src":"'self' https://cdn.jquery.com 'nonce-abc123'","unsafe_inline":false,"unsafe_eval":false,"wildcard":false}