Content Security Policies - Let's Break Stuff

This presentation explains how Content Security Policies help protect websites from attacks such as cross-site scripting. Demonstrations show how policies work, how they can break a site, and how to use their directives and reporting options.

Syllabus

Intro
Background
Crosssite scripting
Cross site scripting
Persistent crosssite scripting
Reflective crosssite scripting
Selfcrosssite scripting
Social engineering
Facebook console
Fight back against hackers
What is a content security policy
Browser support
Resources
Image
Object Source
Style Source
Inline Source
Dont Use It
Nonce
Constant Security
Breaking Production
Breaking the Site
Report URI
Payload
ReportURI
ReportOnly
Over Time
Fun Part
Business buzzwords
Requirements
Gibson
Garbage Files
Update Files
Script
Pop Emoji
Poop Emoji
Corporate Phone Call
Code Base
No poop emojis
No proof emojis
Inline script
Homepage
Gate
Home Page
Garbage File
Content Security Policy
Tips
Cryptographic Nonces
Twig
Multiple Policies
Enforce Report Policies
Test Multiple Policies
Scott Helm
Mr Goodwin
Homework