Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Web-22. CSP Bypass on the Secure Comment Board
Mission
This comment board is protected by a Content Security Policy restricting script execution to the site itself and a trusted CDN. Consider that content served from a "trusted" CDN is not automatically safe.
Hints
Hint 1 Show
CSP is configured, but scripts from cdnjs.cloudflare.com are allowed
Hint 2 Show
Consider using stored XSS to target the administrator's session information
Hint 3 Show
A simulated admin bot periodically visits the page