PlanHub CSP Bypass Arsenal — v11
sendBeacon ✅ confirmed working. Stealth mode now available.
| # | Method | Silent? | Manual? | CSP Risk | Status |
|---|---|---|---|---|---|
| ⭐ | 🔥 Stealth v11 | ✅ Yes | 1 tap dump | None | ✅ CONFIRMED |
| A | 🚀 Popup Sync | No | 1 tap | None | ✅ CONFIRMED |
| B | 📋 Clipboard Bridge | No | Copy+Paste | None | untested |
| C | 📁 Download JSON | No | Download+Upload | None | untested |
| D | 🖼️ Image Pixel | ✅ Yes | None | img-src | ⚠️ fired |
| E | 📡 Direct Fetch | ✅ Yes | None | connect-src | ❌ BLOCKED |
| F | 🔔 sendBeacon | ✅ Yes | None | Bypasses! | ✅ CONFIRMED |
| G | 🔌 WebSocket | ✅ Yes | None | connect-src | ❌ BLOCKED |
| H | 💣 MEGA (All-in-One) | Mixed | 1 tap | Tries all | ✅ Diagnostic |
The production bookmarklet based on confirmed test results. Uses sendBeacon (confirmed to bypass PlanHub's CSP) to silently fire data on every API capture. Also includes a DUMP button that opens the Sync Page as backup. Just browse PlanHub — data gets exfiltrated automatically.
The nuclear option. Intercepts PlanHub API traffic, then fires every exfiltration method simultaneously. Shows a live report of which methods succeeded and which CSP blocked. Run this first to find out what works.
Intercepts data, then opens our sync page in a new window with data in the URL hash. The sync page has no CSP — it freely pushes to Supabase. Uses page navigation (not fetch), so CSP connect-src is irrelevant.
Intercepts data and stores it locally. Shows a floating "COPY" button. Tap to copy the JSON, then open the Sync Page and paste. Zero network from PlanHub.
Intercepts data and generates a downloadable .json file via Blob URL. User downloads the file, then uploads it on the Sync Page.
Silently exfiltrates data by encoding it as query params on <img> tag src URLs. If PlanHub's CSP allows loading images from external domains (common), this works 100% silently with no user interaction.
Straightforward attempt to POST data via fetch(). This was blocked before by connect-src CSP, but included as a baseline test. Also tries no-cors mode as fallback.
Uses navigator.sendBeacon() which is designed for "fire and forget" data. Some browsers treat it differently from fetch for CSP. Worth testing.
Attempts a WebSocket connection. Some CSP implementations treat WS differently from HTTP. If PlanHub's connect-src doesn't explicitly block wss://, this tunnels through.
For methods B (Clipboard) and C (Download), open the sync page to receive and push the data to Supabase.
Open Sync Page →