Skip to content
Bypassing CSP via DOM clobbering
portswigger.net | research | #burp-suite | #web-security | #xss | #dom-invader | #csp-bypass | #dom-clobbering
Summary
How to turn HTML injection into a CSP bypass via DOM clobbering: with a gadget like script.src reaching an allowed sink under strict-dynamic, injected scripts can run; DOM Invader can detect it.
- Published
- Collected