coelner/hacktricks
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

GitBook: [master] one page modified

Browse Source
This commit is contained in:
CPol 2020-07-23 11:40:49 +00:00 committed by gitbook-bot
parent a61d9efa5f
commit 96f0f8a126
No known key found for this signature in database
GPG Key ID: 07D2180C7B12D0FF
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pentesting-web/content-security-policy-csp-bypass.md
View File

@ -2,7 +2,7 @@
## What is CSP
Content Security Policy or CSP is a built-in browser technology which **helps protect from attacks such as cross-site scripting \(XSS\)**. It lists and describes paths and sources, from which the browser can safely load resources. The resources may include images, frames, javascript and more.Here is an example of allowing resource from the local domain \(self\) to be loaded and executed in-line and allow string code executing functions like `eval`, `setTimeout` or `setInterval:`
Content Security Policy or CSP is a built-in browser technology which **helps protect from attacks such as cross-site scripting \(XSS\)**. It lists and describes paths and sources, from which the browser can safely load resources. The resources may include images, frames, javascript and more. Here is an example of allowing resource from the local domain \(self\) to be loaded and executed in-line and allow string code executing functions like `eval`, `setTimeout` or `setInterval:`
`Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval';`