Collected research
Forcing Quirks Mode with PHP Warnings + CSS Exfiltration without Network Requests
Overflowing the PHP input-variable limit emits a warning before the doctype, forcing quirks mode, where the same-origin MIME check is relaxed so a 404 page echoing the URL loads as a stylesheet under a self-only policy. The injected CSS then uses an input pattern and a hidden embed to change window.length, leaking a secret one character at a time with no outbound request.
Record
- Researcher
- arkark
- Published by
- blog.arkark.dev
- Date
- Topic
- XSS
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of arkark, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .