Hello friends! Welcome to my twisted CSP labs! These are the CSP labs with some of the sweetest cheese but you will have to for it.
Here are some ground rules:

• 00.php is supposed to be safe, please report all issues to info@thexssrat.com
• You can always go to the file
• These challenges will get progressively harder
• You can always go back to The listing
• You can grab an excellent CSP guide made simple over at R0hit's page

Introduction

While it's true that CSP is being used to prevent attacks such as XSS, that is not it's only purpose. It also protects against data injection attacks for example. We all know what the impact of these issues can be and they can be devestating. Luckily this protocol has been invented to mitigate the damage attackers can do. It's important to note however CSP can not protect all evils and we need to be careful because a misconfiguration is very easy to make.

What is CSP

CSP is something that your browser needs to support before it can work. This is very important to know and it makes CSP a client-side protection. The server has nothing to do with enforcing the protection but instead only indicates which protection should be available. This can be either in the form of headers (content-security-policy header) or in the meta tag:

  
  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; 
 img-src https://*; child-src 'none';">
  

For more information please refer to the CSP description

First Name

Submit