Content Security Policy — HackXpert Labs

🛡 Content Security Policy

Each lab ships a different policy. The policy is printed on the card, so you can decide what breaks it before you even open the page.

9 labs and targetsfree accountlesson included

How misconfiguration actually works — taught by The XSS Rat

What it is

Nothing here is a coding mistake. A wildcard CORS origin, a CSP with unsafe-inline, a Host header the app trusts, an open redirect - each is a setting that someone chose, and each one is a lever for a bigger bug rather than a finding on its own.

How I attack it

Read the response headers before you touch anything. The misconfiguration is usually sitting in plain sight.
For CORS, test with a weird origin and watch whether it is reflected along with credentials.
For an open redirect, ask what trusts that domain: OAuth flows, password reset links, SSO callbacks.
Chain it. An open redirect plus an OAuth flow is account takeover; a weak CSP plus a sink is XSS.

Learn it from The XSS Rat

▶ Watch: CORS misconfiguration on YouTube ✍ Read: cors on Medium 🎓 Course: WAF Handbook

Free reference reading

PortSwigger Academy: CORS PortSwigger Academy: Host header attacks PortSwigger Academy: clickjacking HackTricks: CORS bypass

The set 9

00 ships no policy at all, 99 is the strict one. The policy each lab sends is printed on its card.

Lab 00

Lab 10

Policy: script-src https://cdnjs.cloudflare.com 'unsafe-eval';

Lab 11

Policy: script-src https://facebook.com https://google.com 'unsafe-inline' https://*; child-src 'none'; report-uri /Report-parsing-url;

Lab 12

Policy: script-src https://facebook.com https://google.com 'unsafe-eval' data: http://*; child-src 'none'; report-uri /Report-parsing-url;

Lab 13

Policy: script-src https://cdnjs.cloudflare.com 'unsafe-eval';

Lab 14

Policy: script-src data: ;

Lab 15

Policy: script-src 'https://*.addthis.com';

Lab 16

Policy: default-src 'self'; script-src 'self' 'unsafe-inline'

Lab 99

Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors none;img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests

Also here 4

CSP explained Exercises Solutions Instructions

Nothing matches thatClear the filter to see everything again.