# Csp Bypass Advanced

Advanced Content Security Policy bypass techniques.

- Repository: https://github.com/yaklang/hack-skills (2601 stars)
- Category: Security
- License: MIT
- Last updated: 2026-09-13
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yaklang/hack-skills --skill csp-bypass-advanced -g -a claude-code -y`
Codex: `npx skills add yaklang/hack-skills --skill csp-bypass-advanced -g -a codex -y`
Cursor: `npx skills add yaklang/hack-skills --skill csp-bypass-advanced -g -a cursor -y`
Gemini CLI: `npx skills add yaklang/hack-skills --skill csp-bypass-advanced -g -a gemini-cli -y`

## Description

Advanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted endpoint abuse, nonce leakage, or exfiltration channels that CSP cannot block.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SKILL: CSP Bypass, Advanced Techniques

> **AI LOAD INSTRUCTION**: Covers per-directive bypass techniques, nonce/hash abuse, trusted CDN exploitation, data exfiltration despite CSP, and framework-specific bypasses. Base models often suggest `unsafe-inline` bypass without checking if the CSP actually uses it, or miss the critical `base-uri` and `object-src` gaps.

## 0. RELATED ROUTING

- [xss-cross-site-scripting](../xss-cross-site-scripting/SKILL.md) for XSS vectors to deliver after CSP bypass
- [dangling-markup-injection](../dangling-markup-injection/SKILL.md) when CSP blocks scripts but HTML injection exists, exfiltrate without JS
- [crlf-injection](../crlf-injection/SKILL.md) when CRLF can inject CSP header or steal nonce via response splitting
- [waf-bypass-techniques](../waf-bypass-techniques/SKILL.md) when both WAF and CSP must be bypassed
- [clickjacking](../clickjacking/SKILL.md) when CSP lacks `frame-ancestors`, clickjacking still possible

---

## 1. CSP DIRECTIVE REFERENCE MATRIX

The rest: https://github.com/yaklang/hack-skills/blob/HEAD/skills/csp-bypass-advanced/SKILL.md