SensePost | Dress code – the talk
- The first part is about the not so well-known CSP bypasses that I found during this
research. These can be of use in your next pentest, bug bounty, etc.
Have a look at the 8 third-party domains that can be abused to bypass a
strict policy to execute that sweet Cross-Site Scripting (XSS) or
clickjacking proof of concept that was initially being blocked.
- The second part takes a step back and delves into the process of getting
Content-Securiy-Policy (CSP) data from top 1 million sites and the
conclusions I draw from it. After reading this part you will get a sense of how widespread and well-implemented CSP is across the Internet. You
will also learn the common pitfalls people fall into when implementing
the policy. The tool I wrote to scan and collect this information and
review the results can be found in https://github.com/sensepost/dresscode