Skip to content
Bypassing CSP using polyglot JPEGs
portswigger.net | research | #burp-suite | #web-security | #xss | #javascript | #csp-bypass | #polyglot-jpeg
Summary
Gareth Heyes shows how to build a polyglot JavaScript/JPEG that remains a valid image yet executes as script, bypassing CSP on sites that host user-uploaded images on the same domain.
- Published
- Collected