Community寫作與編輯github.com

yaklang/csp-bypass-advanced

進階內容安全策略（CSP）繞過技術。當 XSS 或資料外洩被 CSP 阻擋時，用於找出政策弱點、信任端點濫用、nonce 洩漏或 CSP 無法阻擋的外洩通道。

csp-bypass-advanced 是什麼？

此技能提供一系列進階技術，用於繞過內容安全策略（CSP）的防護。當開發者或安全研究人員在進行 XSS 測試或資料外洩利用時，若遭遇 CSP 阻擋，此技能將協助分析 CSP 政策的弱點，包括但不限於：可濫用的信任端點、nonce 值的洩漏管道，以及 CSP 無法完全封鎖的資料外洩通道。支援的技術涵蓋了基於 JSONP 回調、開放重定向、CDN 劫持、CSS 注入等多種主流繞過手法。此技能可在 yaklang 生態系統中執行，並可整合至自動化安全測試流程。其運作原理是透過解析目標 CSP Header、掃描已知漏洞的信任網域、以及偵測 nonce 隨機性弱點，來評估並利用 CSP 的潛在缺陷。

相容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/yaklang/hack-skills/tree/main/skills/csp-bypass-advanced

Installed? Explore more 寫作與編輯 skills: steipete/notion, langchain-ai/langchain, bytedance/podcast-generation · View all 6 →

查看原文→瀏覽所有技能

在你喜歡的 AI 中提問

開啟一個已預先載入此 Agent Skill 的新對話。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

說明文件

csp-bypass-advanced 是做什麼的？

進階內容安全策略（CSP）繞過技術。當 XSS 或資料外洩被 CSP 阻擋時，用於找出政策弱點、信任端點濫用、nonce 洩漏或 CSP 無法阻擋的外洩通道。

功能

  • 解析目標 CSP Header 並識別潛在弱點
  • 掃描可濫用的信任端點，如第三方 CDN (Google, Cloudflare) 或開放重定向
  • 偵測 nonce 洩漏或可預測的 nonce 模式
  • 利用 JSONP、CSS 注入、postMessage 等方式繞過 CSP
  • 輸出繞過向量及相應的 payload 範例

使用方式

yak run csp_bypass_advanced.yak --url "https://target.com"

依賴

  • yaklang 版本：>=1.2.0
  • 網路連線以掃描信任端點

輸出

  • 繞過向量列表（包含技術名稱與 payload）
  • 漏洞弱點描述
  • 修補建議（如限制信任網域、啟用 strict-dynamic 等）

參考資料

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

yaklang/401-403-bypass-techniques

401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.

yaklang/active-directory-acl-abuse

Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.

yaklang/active-directory-certificate-services

AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.

yaklang/active-directory-kerberos-attacks

Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegation abuse, or pass-the-ticket attacks.

yaklang/ai-ml-security

AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealing, data privacy attacks (membership inference, model inversion), and autonomous agent security risks.

yaklang/android-pentesting-tricks

Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.

yaklang/anti-debugging-techniques

Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/exception handlers on Linux and Windows.

yaklang/api-auth-and-jwt-abuse

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

yaklang/api-authorization-and-bola

API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.

yaklang/api-recon-and-docs

API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.

yaklang/api-sec

Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.

yaklang/arbitrary-write-to-rce

Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it into code execution by targeting GOT, hooks, _IO_FILE vtable, exit_funcs, TLS_dtor_list, modprobe_path, .fini_array, or C++ vtables.

yaklang/authbypass-authentication-flaws

Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force resistance, and session boundary flaws.

yaklang/auth-sec

Entry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, and enterprise SSO weaknesses before any deeper auth topic skill.

yaklang/binary-protection-bypass

Binary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF binaries to enable exploitation.

yaklang/browser-exploitation-v8

Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination, and V8 sandbox bypass to achieve renderer RCE and sandbox escape in Chrome/Chromium.

yaklang/business-logic-vuln

Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.

yaklang/business-logic-vulnerabilities

Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.

yaklang/classical-cipher-analysis

Classical cipher analysis playbook. Use when encountering substitution ciphers, Vigenere, transposition, XOR, or encoded text in CTF challenges that requires frequency analysis, Kasiski examination, or known-plaintext cryptanalysis.

yaklang/clickjacking

Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.

相關技能

steipete/notion

Notion CLI/API for pages, Markdown content, data sources, files, comments, search, Workers, and raw API calls.

community

langchain-ai/langchain

The agent engineering platform.

community

bytedance/podcast-generation

Use this skill when the user requests to generate, create, or produce podcasts from text content. Converts written content into a two-host conversational podcast audio format with natural dialogue.

community

composiohq/twitter-algorithm-optimizer

Analyze and optimize tweets for maximum reach using Twitter's open-source algorithm insights. Rewrite and edit user tweets to improve engagement and visibility based on how the recommendation system ranks content.

community

composiohq/competitive-ads-extractor

Extracts and analyzes competitors' ads from ad libraries (Facebook, LinkedIn, etc.) to understand what messaging, problems, and creative approaches are working. Helps inspire and improve your own ad campaigns.

community

upstash/context7

Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

community
← More 寫作與編輯 skills