PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Leaking CSP nonces with CSS & MathML

lab.ctbb.show | research | #csp | #css | #nonce-leak | #mathml
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

# Leaking CSP nonces with CSS & MathML ~/authors/j0r1an - profile j0r1an * * * Jorian Woltjer Oct 05, 2025 Nowadays, browsers prevent CSS Injection from being able to leak `nonce=` attributes,...
Published
Collected

Related coverage

research · portswigger.net
CSS:the bomb inside your inbox
PortSwigger breaks webmail CSS sanitizers to cross trust boundaries, exfiltrate tokens, control AI browsers by email and steal passwords, with attacks spanning Yahoo, Fastmail, ProtonMail and Gmail.
research · portswigger.net
Inline Style Exfiltration: leaking data with chained CSS conditionals
Chained CSS if() conditionals in inline styles exfiltrate attribute data such as usernames via background requests — no selectors or stylesheet imports needed; Burp actions brute-force values.
research · portswigger.net
Blind CSS Exfiltration: exfiltrate unknown web pages
Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.
research · portswigger.net
Using form hijacking to bypass CSP
Form hijacking bypasses CSP via injected forms or formaction attributes while password managers auto-fill credentials. Seen on Infosec Mastodon and PortSwigger's site; Burp added passive scan checks.
research · portswigger.net
Creating a 3D world in pure CSS
A tutorial on building a first-person browsable 3D world with pure CSS and no JavaScript: 3D object placement, perspective and transforms, plus rudimentary keyboard and mouse interactivity.
research · portswigger.net
Hunting nonce-based CSP bypasses with dynamic analysis
How dynamic analysis flagged a nonce-based CSP bypass on portswigger.net: an injected element hijacked a querySelector to control a script URL, defeating what was thought to be a stricter policy.
Back