PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Blind CSS Exfiltration: exfiltrate unknown web pages

portswigger.net | research | #web-security | #csp-bypass | #exfiltration | #css | #blind-injection | #css-injection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.
Published
Collected

Related coverage

research · portswigger.net
Inline Style Exfiltration: leaking data with chained CSS conditionals
Chained CSS if() conditionals in inline styles exfiltrate attribute data such as usernames via background requests — no selectors or stylesheet imports needed; Burp actions brute-force values.
research · portswigger.net
CSS:the bomb inside your inbox
PortSwigger breaks webmail CSS sanitizers to cross trust boundaries, exfiltrate tokens, control AI browsers by email and steal passwords, with attacks spanning Yahoo, Fastmail, ProtonMail and Gmail.
research · portswigger.net
Stealing HttpOnly cookies with the cookie sandwich technique
The cookie sandwich technique wraps a session cookie between quoted values and legacy $Version attributes, making Tomcat misparse the header and expose HttpOnly cookies to scripts.
research · portswigger.net
Bypassing CSP via DOM clobbering
How to turn HTML injection into a CSP bypass via DOM clobbering: with a gadget like script.src reaching an allowed sink under strict-dynamic, injected scripts can run; DOM Invader can detect it.
research · portswigger.net
Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO
A DOM Invader audit of Piwik PRO uncovered an AngularJS-based debugger whose script gadgets can bypass CSP; with an HTML injection, events like ng-focus could execute code despite the policy.
research · portswigger.net
AngularJS CSP bypass in 56 characters
Gareth Heyes chronicles trimming an AngularJS CSP bypass payload from 63 to 56 characters by exploiting the path property and filter syntax, evading the framework's window detection.
Back