PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bypassing CSP via DOM clobbering

portswigger.net | research | #burp-suite | #web-security | #xss | #dom-invader | #csp-bypass | #dom-clobbering
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How to turn HTML injection into a CSP bypass via DOM clobbering: with a gadget like script.src reaching an allowed sink under strict-dynamic, injected scripts can run; DOM Invader can detect it.
Published
Collected

Related coverage

research · portswigger.net
Hijacking service workers via DOM Clobbering
A new service worker hijacking variant using DOM clobbering: abusing a document.getElementById() quirk to control importScripts() and run script inside the SW, enabling filter evasion and CSP bypass.
research · portswigger.net
Finding DOM Polyglot XSS in PayPal the Easy Way
Using DOM Invader, PortSwigger found a polyglot DOM XSS in PayPal hidden in CSS-selector handling, then chained unintended script gadgets to bypass the site's CSP after triage dismissed the report.
research · portswigger.net
Bypassing CSP using polyglot JPEGs
Gareth Heyes shows how to build a polyglot JavaScript/JPEG that remains a valid image yet executes as script, bypassing CSP on sites that host user-uploaded images on the same domain.
research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
research · portswigger.net
Blind CSS Exfiltration: exfiltrate unknown web pages
Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.
research · portswigger.net
Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO
A DOM Invader audit of Piwik PRO uncovered an AngularJS-based debugger whose script gadgets can bypass CSP; with an HTML injection, events like ng-focus could execute code despite the policy.
Back