Collaborate Disseminate
I face a CSP header something like this –
default-src https:; font-src https: data:; img-src https: data:; script-src https: ‘unsafe-inline’ ‘unsafe-eval’; style-src https: ‘unsafe-inline’;
So is this is secure implementation?
This include… Continue reading Is this CSP implementation is secure?
I’m trying to evaluate if a malicious npm dependency running in Electron’s app renderer process (which has sensitive information) could send data from the webpage out to an attacker’s server (or trick the user in some way to input that dat… Continue reading Can malicious code running in isolated Electron’s renderer process send data to attacker’s server?
If a site uses HTTP and not HTTPS, is it useful to include a Content Security Policy? Can an adversary not just remove it?
Continue reading Is CSP meant to be used with HTTPS (TLS) only?
In the past few days, I tried to bypass CSP on a specific site.
I have a site that I successfully managed to trigger a XSS vulnerability. The problem is that I have CSP that blocks my js from triggering, I’m pretty sure that this CSP polic… Continue reading Content Security Policy bypass [closed]
How do Android devices (at least all the non-enterprise personal devices I remember owning) display the wallpaper (usually chosen from the ‘downloads’ folder) on the lock screen when it first is turned on if the image file is supposed to b… Continue reading Storage access permissions before initial unlock upon startup
Recently started with web security and came across to CSP. The idea is to implement js file to base jinja2 template and to use it on one of the templates.
<script type="text/javascript" src="./script.js"></scri… Continue reading How can an external js file be securely added to a jinja2 template with csp?
Is it possible to bypass the CSP with XSS if I can write any kind of code on the testsite, but CSP is set to
script-src ‘none’; sandbox ?
I was thinking of injecting meta tag with specified different CSP so that it ‘overrides’ the one set … Continue reading Bypass CSP, with script-src policy
Google provides a CSP evaluator to validate if a given content-security policy is well set up (github, validator). However, if one uses ‘unsafe-inline’ in the style-src directive this is reported as ‘all good’ (See image below).
Does this … Continue reading Google CSP Evaluator and style-src ‘unsafe-inline’
I am currently working on an implementation reading data from a csv file from within a WordPress plugin. It was suggested the file be added within the plugin in an assets directory. I have concerns in doing this. In particular, I’m worried… Continue reading Does adding a csv file to a wordpress plugin introduce security risks to the site?
In a recent PT assignment, I overcame that a CSP policy where the object-src be set to self. When validated against Google CSP Evaluator, it reported that it the object-src can be set to none instead of self.
Would like to ask for scenario… Continue reading HTML Object Tag