---
id: 5449
title: "Bypassing CSP via DOM clobbering"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/bypassing-csp-via-dom-clobbering"
published_at: "2023-06-05T14:00:00Z"
tags: ["burp-suite", "web-security", "xss", "dom-invader", "csp-bypass", "dom-clobbering"]
phying_url: "https://phying.com/item/5449"
lang: en
---

# Bypassing CSP via DOM clobbering

## Summary

How to turn HTML injection into a CSP bypass via DOM clobbering: with a gadget like script.src reaching an allowed sink under strict-dynamic, injected scripts can run; DOM Invader can detect it.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2023-06-05T14:00:00Z
- **Original:** https://portswigger.net/research/bypassing-csp-via-dom-clobbering
- **Phying News:** https://phying.com/item/5449