Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag
All challengesIn progress
Web-22. CSP Bypass on the Secure Comment Board
Mission
This comment board is protected by a Content Security Policy restricting script execution to the site itself and a trusted CDN. Consider that content served from a "trusted" CDN is not automatically safe.
Not started
Hints
Hint 1Show
CSP is configured, but scripts from cdnjs.cloudflare.com are allowed
Hint 2Show
Consider using stored XSS to target the administrator's session information
Hint 3Show
A simulated admin bot periodically visits the page