More XSS

Cybersecurity Club

Club Stuff

• Challenge writeups at https://blairsec.mbhs.edu/writeups/
• Feel free to do them at home!
• https://forms.blairsec.mbhs.edu and QR codes
• Email: captains@blairse.cc
• Join the mailing list (email the captains or ask on discord)
• Join the discord https://discord.blairsec.mbhs.edu

Content Security Policy (CSP)

• XSS mitigation (among other things)
• Limits the URLs you can access
• HTTP Response header

Example

• content-security-policy: script-src: 'self' https://example.com/
• Allowed: <script src="/foo.js"> <script src="https://example.com/foo.js">
• Disallowed: <script>alert(1)</script> <script src="https://foo.com/foo.js">

​

CSP Directives

• default-src applies to everything
• script-src applies to script tags
• connect-src applies to fetch
• Lots more (learn more here and here)
• Example with multiple directives:
• default-src: 'self'; script-src: 'none'; connect-src: https://a.com/ https://b.com/

Circumventing CSP

• Look through the script-src for any pages that you control and upload the script to there
• If default-src isn't set or is bad, look for abusable directives
• If iframes are allowed and there's a page without CSP, you can abuse that (not needed for this week's challenge)

Try it yourself!

(last week's challenge)

https://xss.blairsec.mbhs.edu/

(this week's fancy CSP challenge)

https://xss2.blairsec.mbhs.edu/