3 ms·
People are missing the point of the story (and the title doesn’t help) CSS here is only used to hide the URL from security checkers, but a JavaScript part is s
by bamboleo 6y ago
People are missing the point of the story (and the title doesn’t help)
CSS here is only used to hide the URL from security checkers, but a JavaScript part is still needed.
CSS alone can’t run scripts nor send the content of an input field.
- KMnO4 6y agoCSS indeed can send the content of an input field [0], but it’s way too much of a hassle to be used in the wild. [0]: https://github.com/maxchehab/CSS-Keylogging https://github.com/maxchehab/CSS-Keylogging
- emmab 6y ago> but it’s way too much of a hassle to be used in the wild. No it's not, it's just rare that you'd have the ability to inject CSS but not JS. A core skill of hacking is being able to see through the things people would normally see as "hassle" or "friction" to the reductionist "what keys do I have to press on the machine in what order to make this happen".
- bamboleo 6y agoNo it cannot. That method misses repeating characters, which makes it pretty useless unless your password is otherwise guessable. Also you have to hope that the order is right. For credit card numbers that means that you’ll miss at least 4 digits and you won’t know their position among 16. I’m not gonna do the math but that’s a few times more than 10000 guesses necessary to find the final number.
- detaro 6y agoThe article was edited, it did earlier claim that there was a CSS feature to include JS code.
- calibas 6y agoI assume it's a script that searches the CSS files for any JS and runs eval()? Yeah, the problem isn't CSS, them problem is whoever thought that was a good idea. Now XSS is a "feature" of CSS.