XSSChallengeWiki

https://xss-game.appspot.com/ (this has a lot of overlap with gruyere) https://github.com/cure53/XSSChallengeWiki/wiki https://sites.google.com/site/infosecrocks/ (this links to some of the other stuff I mentioned) https://www.hacking-lab.com There's also these 2 advanced XSS challenges: https://alf.nu/alert1 https://prompt.ml/0 I'm not sure if they're still functional, I think some of their solutions require functionality that browsers have since changed. You might also want to check out the Youtube channel Live Overflow: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w

Whitelisting entire CDNs like that is incredibly dangerous, see https://github.com/cure53/XSSChallengeWiki/wiki/H5SC-Minicha...

From what I've seen, no -- but that depends what you mean by "properly configured." If you look at challenges like this ( https://github.com/cure53/XSSChallengeWiki/wiki/H5SC-Minicha... ), you'll see that CSP appears to be properly configured, but there are actually ways to bypass. It's problems like this that I've seen "in the wild" most of the time. The other side of the argument is that not many people are building web applications with CSP built-in from the beginning. If you don't start development with CSP in mind, it can become very cumbersome to put CSP into place (outside of report-only mode). As a result, a lot of people are currently using CSP as just report-only analytics on potential violations.