Awesome Open Source
Awesome Open Source

CSP Bypass

This is a Burp plugin that is designed to passively scan for CSP headers that contain known bypasses as well as other potential weaknesses.

CSP Bypass


Jython Setup

  1. Download the latest standalone Jython 2.7.x .jar file
  2. In Burp select Extender and then the Options tab, under the Python Environment heading click Select File ... and browse to the Jython .jar file

CSP Bypass Plugin Setup

  1. Execute the script, you should see a file appear
  2. In Burp select Extender and then the Extensions tab
  3. Click Add in the window that appears, select Python from the Extension Type dropdown menu
  4. Click Select File ... next to Extension File and select the generated file
  5. Click Next and you're done!

Report Bypasses in Common Domains

To add bypasses simply edit with a domain, and an example payload or description of the bypass. Be sure to use the full domain, the plugin will match wildcards (e.g. if a policy allows * it will match against Submit a pull request to get your bypass in the main repository!

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
python (53,485
security (1,874
csp (32
burp-plugin (27