Chrome extension and Express server demonstrating a CSS-based keylogging attack on password inputs.
CSS Keylogging is a proof-of-concept security demonstration that shows how CSS can be exploited to capture keystrokes, including passwords, from web pages. It consists of a Chrome extension that injects malicious CSS and an Express server that logs the captured keystrokes. The project highlights a specific vulnerability where CSS attribute selectors can be used to exfiltrate input data via external resource requests.
Security researchers, penetration testers, and web developers interested in understanding client-side security vulnerabilities, particularly those involving CSS injection and side-channel attacks.
It provides a concrete, working example of a subtle but significant security flaw that many developers may overlook, emphasizing the risks of uncontrolled CSS in web applications. Unlike generic security tutorials, it offers a complete, runnable setup with a Chrome extension and logging server to practically demonstrate the exploit.
Chrome extension and Express server that exploits keylogging abilities of CSS.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Provides a complete, runnable setup with a Chrome extension and Express server, as detailed in the README's setup instructions, allowing practical experimentation with the exploit.
Demonstrates how CSS attribute selectors can exfiltrate data via background-image requests, with specific examples in the README like the CSS rule for password inputs ending with 'a'.
Uses a script to generate CSS rules for every ASCII character, ensuring broad input capture as mentioned in the key features, making it effective for proof-of-concept testing.
Highlights a specific, overlooked vulnerability in web security, targeting security researchers and developers for awareness, as stated in the philosophy and target audience.
The README specifies it works on sites like Instagram that use controlled frameworks like React, so it may not apply to all web applications or input methods.
Requires installing a Chrome extension and running an Express server, which can be cumbersome for quick demos or users unfamiliar with Node.js and browser extensions.
While it demonstrates the vulnerability, the project doesn't provide solutions or best practices for preventing CSS keylogging attacks in real applications.
As a keylogging tool, it could be misused for malicious purposes, and the project doesn't emphasize responsible usage or legal considerations, posing risks for untrained users.