Using form hijacking to bypass CSP

Published

2024-03-05 14:55

Collected

2026-07-22 04:47

---
id: 5063
title: "Using form hijacking to bypass CSP"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/using-form-hijacking-to-bypass-csp"
published_at: "2024-03-05T14:55:00Z"
tags: ["burp-suite", "web-security", "password-managers", "csp", "bypass", "form-hijacking"]
phying_url: "https://phying.com/item/5063"
lang: en
---

# Using form hijacking to bypass CSP

## Summary

Form hijacking bypasses CSP via injected forms or formaction attributes while password managers auto-fill credentials. Seen on Infosec Mastodon and PortSwigger's site; Burp added passive scan checks.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2024-03-05T14:55:00Z
- **Original:** https://portswigger.net/research/using-form-hijacking-to-bypass-csp
- **Phying News:** https://phying.com/item/5063