Check out [https://fadec0d3.blogspot.com/2021/03/bsidessf-2021-web-challenges.html#csp-1](https://fadec0d3.blogspot.com/2021/03/bsidessf-2021-web-challenges.html#csp-1) for writeup with images.
---
If we look at the Content Security Policy (CSP) for this page, we can see it'svery open. To identify this, you can learn each rule or use a tool such as [https://csp-evaluator.withgoogle.com/](https://csp-evaluator.withgoogle.com/).
The CSP in this case was:
```javascriptdefault-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src-elem 'self'; connect-src *```
The unsafe-inline keyword will allow execution of arbitrary inline scripts.
Let's start with a simple XSS payload:
```html```
This already works! So now we only need to get the flag from the`/csp-one-flag` route after the admin visits it. We can use [fetch](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) for this.We'll also use [https://requestbin.io/](https://requestbin.io/) again.
Here's the final payload submitted to the admin:
```html```
And we get a flag back on the RequestBin side:
```CTF{Can_Send_Payloads}```