Skip to content
All lessons

Tech Insights· attackshipsonfi.re

Exploiting CSP Wildcards for Google Domains

From attackshipsonfi.re

TL;DR The Google developer documentation includes CSP examples which use domain wildcards (which have been widely cut & pasted), and additionally there are numerous endpoints within the Google eTLDs which are vulnerable to Javascript XSS.

Shared by Ricardo Morato Rocha

Read on attackshipsonfi.re

Book a call

Lessons like this one
shape how we build.

Tell us what you’re building. In one call, we’ll show you how our team would approach it.

Tell us what you’re building, and we’ll show you how we’d approach it.

Still prefer the good old email? Contact us