Content-Security-Policy (CSP) whitelists trusted hosts for scripts/resources — but if a whitelisted domain is vulnerable to subdomain takeover (expired DNS, dangling CNAME, abandoned cloud service), an attacker can host malicious assets and bypass CSP.
How to find them:
Use cspgrabber - to extract domains/subdomains from CSP headers across your targets, then feed results to Nuclei’s subdomain-takeovers profile to detect takeovers that could bypass CSP.
One-liner example:
./cspgrabber -f alive_http_services.txt -c 40 -rps 120 -clean -o csp_domains.txt && \
nuclei -l csp_domains.txt -profile subdomain-takeovers -nh -o takeovers.txt
#bugbountytips