Content Security Policy Scanner
Analyzes CSP headers for misconfigurations and bypass opportunities.
What is Content Security Policy?
Content Security Policy (CSP) is a security header that controls which resources (scripts, styles, images) can load on a page. CSP misconfigurations—unsafe-inline, unsafe-eval, overly broad wildcards, or missing directives—can allow XSS attacks that would otherwise be blocked.
Why is This Important?
CSP is a critical defense-in-depth against XSS. Misconfigurations leave this protection ineffective, and attackers actively look for CSP bypasses. A weak CSP provides false security while allowing attacks to succeed.
How It Works
1. Web Crawling
Intelligent crawling discovers all endpoints, forms, parameters, and dynamic content across your web application.
2. Payload Injection
AI-powered payloads test each input vector for web vulnerabilities with context-aware attack patterns.
3. Response Analysis
Advanced analysis detects vulnerability signatures in responses, confirming exploitability with proof-of-concept.
Key Capabilities
Industry-leading web security testing powered by AI, trusted by security teams worldwide for accurate vulnerability detection.
- Deep web crawling with JavaScript rendering support
- Context-aware payload generation for each parameter
- False positive elimination through response analysis
- OWASP Top 10 and CWE compliance mapping
- Seamless CI/CD and DevSecOps integration
Frequently Asked Questions
What are common CSP bypasses?
JSONP endpoints, Angular/Vue template injection on allowed CDNs, base-uri manipulation, unsafe-inline usage, and finding executable content on whitelisted domains.
Why is 'unsafe-inline' dangerous?
It allows inline scripts, which is exactly what XSS attacks inject. With unsafe-inline, CSP provides no protection against most XSS attacks.
Should I use nonces or hashes?
Nonces (random per-request values) are generally easier to implement. Hashes work for static inline scripts. Both are much safer than unsafe-inline.
What's a good starter CSP?
Start with default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; and refine based on your needs.
Related Scanners
Ready to secure your application?
Start testing for content security policy vulnerabilities today.
Get Started Free