
CSP B Gone por Hacks and Hops
Check the CSP of the current website against a list of known bypasses.
Irá necessitar do Firefox para utilizar esta extensão
Metadados da extensão
Capturas de ecrã

Acerca desta extensão
Code
This addon is free and open-source software (FOSS) all code can be found here: https://github.com/ACK-J/CSP-B-Gone
Please report your bugs or feature requests in a GitHub issue instead of in a review.
Test if it works!
https://apple.com/
This addon checks the CSP of the current website against a list of known bypasses. You can also use the search bar to check if a specific domain has a known CSP bypass.
How Does a CSP Bypass Work?
The most common way to bypass CSP is by finding a JSONP endpoint on a trusted domain within the CSP. JSONP takes advantage of the fact that the same-origin policy does not prevent execution of external <script> tags. Usually, a <script src="some/js/file.js"> tag represents a static script file. But you can just as well create a dynamic API endpoint, say /userdata. jsonp, and have it behave as a script by accepting a query parameter (such as ?callback=CALLBACK).
JSONP endpoints used to bypass CSP are discovered by querying the archive.org database on a monthly basis for URLs with a common feature set. Each suspected URL is injected into a script src element inside a headless browser with the alert() function hooked. If an alert box fires then the URL is a confirmed JSONP endpoint and added to the GitHub list HERE.
When would I need a CSP Bypass?
A Content Security Policy (CSP) bypass may be necessary in specific scenarios, typically related to web security testing or development. CSP is a security feature that helps prevent a range of attacks like Cross-Site Scripting (XSS), data injection attacks, and clickjacking by controlling which resources the browser is allowed to load and execute.
Donations
This addon is free and open-source software (FOSS) all code can be found here: https://github.com/ACK-J/CSP-B-Gone
Please report your bugs or feature requests in a GitHub issue instead of in a review.
Test if it works!
https://apple.com/
This addon checks the CSP of the current website against a list of known bypasses. You can also use the search bar to check if a specific domain has a known CSP bypass.
How Does a CSP Bypass Work?
The most common way to bypass CSP is by finding a JSONP endpoint on a trusted domain within the CSP. JSONP takes advantage of the fact that the same-origin policy does not prevent execution of external <script> tags. Usually, a <script src="some/js/file.js"> tag represents a static script file. But you can just as well create a dynamic API endpoint, say /userdata. jsonp, and have it behave as a script by accepting a query parameter (such as ?callback=CALLBACK).
JSONP endpoints used to bypass CSP are discovered by querying the archive.org database on a monthly basis for URLs with a common feature set. Each suspected URL is injected into a script src element inside a headless browser with the alert() function hooked. If an alert box fires then the URL is a confirmed JSONP endpoint and added to the GitHub list HERE.
When would I need a CSP Bypass?
A Content Security Policy (CSP) bypass may be necessary in specific scenarios, typically related to web security testing or development. CSP is a security feature that helps prevent a range of attacks like Cross-Site Scripting (XSS), data injection attacks, and clickjacking by controlling which resources the browser is allowed to load and execute.
Donations
- Monero Address: 89jYJvX3CaFNv1T6mhg69wK5dMQJSF3aG2AYRNU1ZSo6WbccGtJN7TNMAf39vrmKNR6zXUKxJVABggR4a8cZDGST11Q4yS8
Avalie a sua experiência
PermissõesSaber mais
Este extra precisa de:
- Aceder aos separadores do navegador
- Aceder aos seus dados para todos os sites
Mais informação
- Ligações do extra
- Versão
- 1.0
- Tamanho
- 28,6 KB
- Última atualização
- há 4 meses (17 de dez de 2024)
- Categorias relacionadas
- Licença
- Apenas a GNU General Public License v3.0
- Histórico de versões
- Etiquetas
Adicionar à coleção
Mais extensões por Hacks and Hops
- Não existem avaliações ainda
- Não existem avaliações ainda
- Não existem avaliações ainda
- Não existem avaliações ainda
- Não existem avaliações ainda
- Não existem avaliações ainda