XSS DETECTED! Alert was called!

Advanced XSS Lab

WAF Bypass | CSP Evasion | Filter Bypass | Advanced Techniques
ADVANCED

Challenges

1 WAF Bypass - Script Tag Blocked 2 WAF Bypass - Event Handler Blocked 3 WAF Bypass - Case & Encoding 4 CSP Bypass - Nonce 5 CSP Bypass - unsafe-inline blocked 6 Mutation XSS (mXSS) 7 Blind XSS 8 Polyglot XSS
Level 5: CSP Bypass - unsafe-inline blocked
CSP is script-src 'self' (no unsafe-inline, no unsafe-eval). There is a JSONP-like endpoint at /index.php?jsonp_callback=XYZ. Use it to bypass CSP!
Expert
Content Security Policy
CSP: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'
Available endpoint: /index.php?jsonp_callback=FUNCTION_NAME
Show Hint
Load the JSONP endpoint as a script source: <script src="/index.php?jsonp_callback=alert(1)//"></script>. The JSONP endpoint is on the same origin (self) so CSP allows it.