Deep Content-Security-Policy analysis - per-directive source classification and real bypass detection.
CSP Evaluator parses a target’s Content-Security-Policy directive by directive and classifies every source expression (safe / ok / warning / dangerous), then judges whether the policy actually blocks XSS or just looks like it does. A CSP can be present yet trivially bypassable - this tool tells the difference.
It detects the bypasses that matter in real testing: unsafe-inline / unsafe-eval, wildcard and bare-scheme sources (*, https:, data:), a missing object-src / base-uri / default-src, and - crucially - allow-listed hosts that are known to serve JSONP endpoints or AngularJS (the classic CSP whitelist bypass). It is nonce/hash-aware, so it correctly down-grades an unsafe-inline that modern browsers ignore.
Feed it a live URL (it reads the header, <meta> tag or report-only policy and is multi-policy aware) or paste a raw policy you found. Every result comes with a graded score and a ready-to-use hardened policy.
*, https:/http:, data: in script-src.If script-src allows a host that serves JSONP endpoints or hosts AngularJS (e.g. ajax.googleapis.com, *.googleapis.com, cdnjs.cloudflare.com), an attacker can load attacker-controlled script from that trusted host and execute it without violating the CSP. The tool flags these hosts automatically.
No - CORS has its own dedicated CORS Misconfig Tester (probe battery + PoC). This tool focuses entirely on getting CSP analysis right.
It allows inline scripts and event handlers to run, which is exactly what most XSS relies on. The exception: if a nonce or hash is also present, modern browsers ignore unsafe-inline - and the tool accounts for that.