CSP Bypass - Dangling markup 2 root-me (web-client)

Bypass CSP with Dangling markup to exfiltrate the HTML. To solve it we used the &tag instead of the &or similar ones to exploit because of Chrome protections. So, once we know it we can use the &attribute pointing to a URL controlled by us and making a GET Request with the query part being equal to the HTML of the admin because of the malformed &tag. By this way we can exfiltrate it. More info in: