Analyze Content-Security-Policy headers and bypass them to achieve cross-site scripting by exploiting unsafe-inline/unsafe-eval, whitelisted JSONP endpoints, base-uri and form-action gaps, and nonce/hash weaknesses, then exfiltrate data even without script-src control. Use during web application security assessments or bug bounty hunting when XSS is found but blocked by CSP, or when auditing CSP header configuration for weaknesses.
