> For the complete documentation index, see [llms.txt](https://kryptocoder.gitbook.io/hacking-knowledge/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kryptocoder.gitbook.io/hacking-knowledge/web-exploitation-wip/web-vulnerabilities-wip/content-security-policy-bypass-wip.md).

# Content Security Policy Bypass (WIP)

The *Content-Security-Policy* header defines rules for the validation of certain requests or inputs on an application. To bypass this verification we can modify the rules by poisoning our input.

Here we find an example of this scenario:

* A site lets us upload an image by entering the link of the location, and this process is validated with the security policy

{% code title="Example Response" overflow="wrap" lineNumbers="true" fullWidth="false" %}

```http
HTTP/1.1 200 OK
host: host
Content-Security-Polic: img-src 'self' /src/image script-src 'self' $RestOfPolicy
...
```

{% endcode %}

***

* We can poison the input by adding a modified configuration for the security policy header, and after this, the other functions of the app where the security policy is applied will not be filtered properly, allowing us to use injections

{% code overflow="wrap" lineNumbers="true" fullWidth="false" %}

```bash
$input script-src 'unsafe-inline" 'self' $RestOfPolicy   #Fill on the image link
```

{% endcode %}