Level 4: CSP Bypass - Nonce
The page has CSP with
script-src 'nonce-abc123'. Your input is reflected inside the href attribute of an anchor tag. Bypass the CSP!Content Security Policy
CSP: script-src 'nonce-abc123'Input is reflected in:
<a href="INPUT">Click me</a>
Show Hint
CSP nonce applies to inline scripts, but
javascript: URIs in href are NOT blocked by nonce-only CSP in some browsers. Try: javascript:alert()