你即將離開本站

並前往https://balsn.tw/ctf_writeup/20200905-confidence2020ctffinals/

CONFidence 2020 CTF Finals - Balsn

Based on JSESSIONID , we know this is a Java application. ... We have to somehow inject <script src="/flag"> with valid nonce.

確定！ 回上一頁

查詢 「CSP nonce java」的人也找了：

  1. CSP nonce java
    2.
  2. Content Security Policy
    3.
  3. Content Security Policy test
    4.
  4. Spring Content-Security-Policy
    5.
  5. Content Security Policy Java
    6.
  6. Script nonce
    7.
  7. Nonce spring boot
    8.
  8. Refused to frame '' because it violates the following Content Security Policy directive: frame-src
    9.