> For the complete documentation index, see [llms.txt](https://unsbotch.gitbook.io/unsbotch/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://unsbotch.gitbook.io/unsbotch/my-writeups/xssy/csp-data-url-bypass.md). # CSP - Data URL Bypass CSP - Data URL Bypass - medium challenge with 14 solutions, based for csp bypass.

As always checking entry points of input on basic XSS payload:

Payload inserted as we need but alert didn't return, as name of challenge is "CSP Bypass" it was expected, if we look at console:

We have an configuration of CSP and first thing what we need to do is check csp evaluator:

"Data" - allows us to use script tags with this csp, but what is it?\ Data:URI (Uniform Resource Identifier) is a resource identifier scheme that allows you to embed data directly into your pages or documents instead of referencing external files via URLs. I have encountered with XSS via data protocol before and we can trigger an XSS with just following payload: ``