◉ Official answer
🎯 CSP Policy Guardian (Defensive · Level 2 · +180 XP)
A web portal accepts dynamic user-submitted profile markup and unvetted third-party widgets, leaving it exposed to remote and inline script execution. Construct and deploy a zero-trust Content Security Policy (CSP) header specifying default-src, script-src, object-src, and base-uri directives to neutralize the attacks and uncover the defense confirmation flag.
Learning & Defense Goals:
- Analyze unvetted inline script and plugin execution attack vectors
- Construct a zero-trust Content Security Policy (CSP) header with default-src and script-src directives
- Run the defense attack simulator to verify all malicious script injections are blocked and extract the flag
🎯 Launch Isolated Sandbox on Cyber Lab →
Community Discussion Rules: Discuss methodologies, discovery tactics, and architectural hardening. Please do not post raw flags directly. Share your production remediation code!