Content Security Policy Bypass: Exploiting Misconfigurations

Content Security Policy (CSP) is designed to help mitigate content injection attacks such as XSS. While it can be helpful as a part of a defense-in-depth strategy, misconfigurations may be bypassed, especially when used as a sole defensive mechanism. Content Security Policy configurations can be...

By

James Casteel

July 15, 2021

All papers are copyrighted. No re-posting of papers is permitted

Related Content

Offensive Operations, Pen Testing, and Red Teaming, Open-Source Intelligence (OSINT), Penetration Testing and Red Teaming

November 16, 2023

A Visual Summary of SANS HackFest Summit

Check out these graphic recordings created in real-time throughout the event for SANS HackFest Summit 2023

Cybersecurity and IT Essentials, Penetration Testing and Red Teaming

December 6, 2022

Don’t Miss the 2022 SANS Holiday Hack Challenge – Now Open for Free Play

SANS’s annual festive gift to the cyber community is back with a new supervillain to thwart.

Ed Skoudis

Penetration Testing and Red Teaming

October 13, 2020

Red Team Tactics: Hiding Windows Services

A little known feature of Windows allows attackers to hide persistent services from view, creating an opportunity to evade threat hunting detection.