Skip to content
Hunting nonce-based CSP bypasses with dynamic analysis
portswigger.net | research | #xss | #burp-scanner | #dynamic-analysis | #nonce | #csp | #script-gadgets
Summary
How dynamic analysis flagged a nonce-based CSP bypass on portswigger.net: an injected element hijacked a querySelector to control a script URL, defeating what was thought to be a stricter policy.
- Published
- Collected