CSS-Keylogging
Chrome extension and Express server demonstrating a CSS-based keylogging attack on password inputs.
What is CSS-Keylogging?
CSS Keylogging is a proof-of-concept security demonstration that shows how CSS can be exploited to capture keystrokes, including passwords, from web pages. It consists of a Chrome extension that injects malicious CSS and an Express server that logs the captured keystrokes. The project highlights a specific vulnerability where CSS attribute selectors can be used to exfiltrate input data via external resource requests.
Security researchers, penetration testers, and web developers interested in understanding client-side security vulnerabilities, particularly those involving CSS injection and side-channel attacks.
It provides a concrete, working example of a subtle but significant security flaw that many developers may overlook, emphasizing the risks of uncontrolled CSS in web applications. Unlike generic security tutorials, it offers a complete, runnable setup with a Chrome extension and logging server to practically demonstrate the exploit.
Overview
Chrome extension and Express server that exploits keylogging abilities of CSS.
Use Cases
Best For
- Demonstrating CSS-based keylogging attacks in security training or workshops.
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
