Csp Bypass Advanced
Advanced Content Security Policy bypass techniques.
Install
npx skills add yaklang/hack-skills --skill csp-bypass-advanced -g -a claude-code -y- Repository
- yaklang/hack-skills2.6k
- Category
- Security
- Updated
- 2mo ago
- License
- MIT
- Context cost
- Mediumabout 2,981 tokens
- Runs scripts
- No, instructions only
What it does
Advanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted endpoint abuse, nonce leakage, or exfiltration channels that CSP cannot block.
SKILL: CSP Bypass, Advanced Techniques
AI LOAD INSTRUCTION: Covers per-directive bypass techniques, nonce/hash abuse, trusted CDN exploitation, data exfiltration despite CSP, and framework-specific bypasses. Base models often suggest
unsafe-inlinebypass without checking if the CSP actually uses it, or miss the criticalbase-uriandobject-srcgaps.
0. RELATED ROUTING
- xss-cross-site-scripting for XSS vectors to deliver after CSP bypass
- dangling-markup-injection when CSP blocks scripts but HTML injection exists, exfiltrate without JS
- crlf-injection when CRLF can inject CSP header or steal nonce via response splitting
- waf-bypass-techniques when both WAF and CSP must be bypassed
- clickjacking when CSP lacks
frame-ancestors, clickjacking still possible
