CSP for Pentesters: Understanding the Fundamentals
4 hours ago
- #Pentesting
- #Web Security
- #CSP
- CSP (Content Security Policy) acts like a bouncer for your browser, blocking unauthorized scripts.
- Common directives include 'script-src', 'default-src', 'object-src', and 'base-uri', each controlling different resources.
- Special values like 'self', 'none', 'unsafe-inline', and 'unsafe-eval' define what is allowed or blocked.
- Misconfigurations such as 'unsafe-inline', missing 'base-uri', or wildcards (*, https:) often lead to vulnerabilities.
- Tools like CSP Evaluator can help analyze policies for weaknesses.
- CSP can be set via HTTP headers or meta tags, with the most restrictive policy taking precedence.