ruulian/cspass

This tool allows to automatically test for Content Security Policy bypass payloads.

Hi everyone 👋

I am a french cybersecurity and low level enjoyer. I like to pwn everything even if I can't pwn everything yet.. You can find my posts on my blog and my tools here.

🔨 Tools

Pwn:

• initramfs-toolkit : Toolkit that allows to extract and compress initramfs cpio, useful for Linux kernel exploitation.

Web:

• WConsole Extractor : Automatically exploits a Werkzeug development server in debug mode with an arbitrary file read
• CSPass : Automatically test for Content Security Policy bypass payloads.

📄 Posts

writeups:

• Pwn - FCSC 2024 Zarby Write : 3 arbitrary writes with given libc leak

• Pwn - FCSC 2024 Holy Cow : v8 exploit with given hole leak

• Reverse - VikeCTF 2024 Blackjack : blackjack game with time seed

• Web - FCSC 2022 Cloud Password Manager : CSS Injection to leak admin password

• Web - XMASCTF 2021 Quotehub : Clickjacking to leak admin CSRF token

📧 Contact

You can reach me on twitter or on discord:

• Twitter: @Ruulian_
• Discord: ruulian

cspass's Issues

Issue when formatting CSP

Hi, after your presentation for TheBlackSide, I just wanted to try your tool briefly ^^.

There seems to be an issue when formatting CSP. When running your tool, I have this issue:
Traceback (most recent call last):
File "cspass.py", line 364, in
csps = page.format_csp()
File "cspass.py", line 192, in format_csp
csp[policyname] = " ".join(self.csp[policyname])
TypeError: 'str' object does not support item assignment

I did not read the code thoroughly and do not have a lot of time today, but I think you probably just have an indentation issue in format_csp function (seems to work on my tests when fixing it and it did not seem to break something else (I only saw one call to format_csp)) :
"csp = json.dumps(csp,indent=4 )" should not be in the for loop because then it is a string and no more a dictionary, so if you have more than one policy "policyname", it crashes. Just change its indentation (same as your "return csp" line just after).

Thanks for your tool :)