Sh*t, it's CSP!

CSP ruined my Pentest-Report! Wait, yours too? Let's do something about it :) Welcome to yet another XSS challenge. This time, you, the fellow contestant, are confronted with a powerful adversary: The Content Security Policy. CSP is cool. Even if the websites in scope are injectable, an attacker cannot do no nothing no more. Perfect. Let's throw escaping, encoding and filtering overboard because t