71–80 of 173 posts
This has nothing to do with vulnerabilities in CSS or Javascript. It has to do with ill-conceived authentication implementations, written in Javascript, that save passwords in the DOM using attributes that are then accessible via CSS. That is a vulnerability on the website itself. It is also an idiotic thing to do.
You'd have to have all permutations of any length password in the css file AND it would have to be pre-filled using the value attribute. The original post on this talks about it in more detail: https://www.mike-gualtieri.com/posts/stealing-data-with-css-... Summary: A method is detailed - dubbed CSS Exfil - which can be used to steal targeted data using Cascading Style Sheets (CSS) as an attack vector. Due to the mod…
It is using an attribute selector that matches against the last character only - so no giant file of permutations required.
This is neat but doesn't really work as an attack. The CSS selectors work on the value HtmlNode attribute rather than the Javascript "value" value, which aren't linked normally. The Instagram password field mentioned in the readme.md DOES work this way due to some custom javascript, for reasons that escape me. [edit] Other people pointed this out first. Also, if you are going to all the trouble of making an extension…
If this would work, it could spy even without React. Detect first character, then server returns next CSS to detect second character and so on.
This is neat but doesn't really work as an attack. The CSS selectors work on the value HtmlNode attribute rather than the Javascript "value" value, which aren't linked normally. The Instagram password field mentioned in the readme.md DOES work this way due to some custom javascript, for reasons that escape me. [edit] Other people pointed this out first. Also, if you are going to all the trouble of making an extension…
> The Instagram password field mentioned in the readme.md DOES work this way due to some custom javascript, for reasons that escape me Instagram is a React app and React works that way.
I hate the internet.
input[type="password"] {
background-image: url(attr(value));
}
?To be really dangerous, I think this would need to defeat client-side cache strategies. If the browser caches each resource, the server-side reads wouldn't account for repeated characters or overall length with perfect accuracy. Consider palindromes like "racecar." This would still put many, if not most, passwords within guessable striking distance, for anyone able to intercept plain-text HTTP traffic, between Alice…