Lion Cipher Lab
Stop a third-party script skimmer with Subresource Integrity
- AppSec / DevSecOps
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Almost every real website loads JavaScript from somebody else's server -- analytics, chat widgets, payment helpers, ad tags, font loaders. Each of those <script src> lines is a permanent, unlimited grant: that vendor's code runs inside YOUR page, with full access to your DOM, your forms, your cookies and your users' keystrokes, and it is re-downloaded fresh on every page load, so whatever the vendor ships tomorrow runs on your checkout tomorrow. That is exactly how the Magecart family of card-skimming breaches worked: the attackers compromised a script provider rather than the victim…
What you'll learn
- seeing that a third-party <script src> has exactly the same power over your page as your own code
- reproducing the Magecart / web-skimming pattern safely on two local origins you own
- reading an exfiltration request in the browser DevTools Network tab
- generating a Subresource Integrity digest with openssl dgst -sha384 -binary and openssl base64 -A
- pinning a remote script with integrity= and crossorigin=, and knowing why cross-origin SRI needs CORS
- recognising the browser's integrity-mismatch console error and proving the script never executed
- using a CSP script-src allowlist and connect-src as supply-chain controls, not as an XSS fix
- naming precisely what SRI does NOT solve, and choosing self-hosting versus pinning on purpose
Steps in this lab
- The grant you make every time you write <script src=>
- Build the shop and the CDN as two separate local origins
- Serve both origins and confirm the third-party script works
- Put on the attacker hat: compromise the CDN, not the shop
- Watch the card leave, in the Network tab
- Generate the digest: what a sha384- string actually is
- Pin it -- and hit the CORS wall that teaches you what SRI needs
- Re-run the attack and watch the browser refuse it
- Layer a CSP allowlist -- as a supply-chain control, not an XSS fix
- What SRI does NOT solve -- five honest gaps
- The pro move: self-host first, pin second, and the compliance hook