index.html

<html>  
  <head>  
    <title>XSS attack by CSP Bypass Demo</title>
 <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js"></script>  
  <script src="http://cdnjs.cloudflare.com/ajax/libs/jquery.form/3.51/jquery.form.min.js"></script>  
  <script>  
  $(document).ready(function() {  
     $('#uploadForm').submit(function() {  
         $("#status").empty().text("File is uploading...");  
  
        $(this).ajaxSubmit({  
  
            error: function(xhr) {  
                    status('Error: ' + xhr.status);  
            },  
  
            success: function(response) {  
                    console.log(response)  
                    $("#status").empty().text(response);  
            }  
    });  
  
    return false;  
    });      
});  
  </script>
  <style>
	body {
    background-color: rgb(179, 255, 179);
    color: black;
    outline-color: black;
	}
  </style>
  <meta http-equiv="X-UA-Compatible" content="ie=edge"/>
  </head>  
  <body>
      <h1>Bypassing CSP using XSS Polyglot Attack - Demo by rachejazz</h1>
	  <h4>Link to repo: <a href="https://github.com/rachejazz/csp-xss-demo">https://github.com/rachejazz/csp-xss-demo</a></h4>
      <form id="uploadForm" enctype="multipart/form-data" action="/form" method="post">  
       <input type="file" name="myfile" /><br/><br/>  
       <input type="submit" value="Upload File" name="submit"><br/><br/>  
       <span id="status"></span>  
      </form>
	<p>
		<a href="/uploads">Check uploads directory</a><br><br><span></span>
		<a href="/list">enter uploader name</a>
	</p>
  </body>  
</html>  