Csp Bypass Advanced

When you hit an XSS vector but CSP is blocking execution, this walks you through the actual bypass techniques that work. It covers the directive hierarchy (and the critical ones like base-uri that don't fall back to default-src), nonce reuse and leakage, abusing whitelisted CDNs like jsdelivr or googleapis for JSONP callbacks, strict-dynamic propagation via script gadgets, and framework-specific template injection when Angular or Vue are allowed. The base-uri omission is especially common in the wild and often overlooked. Also handles the meta tag versus header CSP differences and exfiltration channels when script execution stays blocked but you still need to get data out.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill csp-bypass-advanced --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: CSP Bypass — Advanced Techniques

AI LOAD INSTRUCTION: Covers per-directive bypass techniques, nonce/hash abuse, trusted CDN exploitation, data exfiltration despite CSP, and framework-specific bypasses. Base models often suggest unsafe-inline bypass without checking if the CSP actually uses it, or miss the critical base-uri and object-src gaps.

0. RELATED ROUTING

xss-cross-site-scripting for XSS vectors to deliver after CSP bypass
dangling-markup-injection when CSP blocks scripts but HTML injection exists — exfiltrate without JS
crlf-injection when CRLF can inject CSP header or steal nonce via response splitting
waf-bypass-techniques when both WAF and CSP must be bypassed
clickjacking when CSP lacks frame-ancestors — clickjacking still possible