Later archive addition

Stealing CSRF tokens with CSS injection (without iFrames)

dxa4481 · GitHub

The project demonstrates exfiltrating CSRF tokens with CSS injection and attribute selectors, without relying on iframes. Repeated selector rules test token prefixes and trigger outbound requests for matches, allowing a secret value embedded in the page to be reconstructed one character at a time.

Record

Researcher

dxa4481

Published by

GitHub

Format

Repository

In the archive

• Added to the 2018 archive after the original list was published

Tags

• css-injection
• csrf
• data-exfiltration
• side-channel
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of dxa4481, first published at the original source. Preserved copies are kept so the citation survives its host.