Stealing CSRF tokens with CSS injection (without iFrames)
A proof-of-concept demonstrating how to steal CSRF tokens via CSS injection without using iFrames, enabling client-side attacks.
What is Stealing CSRF tokens with CSS injection (without iFrames)?
dxa4481/cssInjection is a proof-of-concept security demonstration that shows how attackers can steal CSRF tokens from websites using CSS injection without relying on iFrames. It exploits CSS attribute selectors to leak sensitive data from HTML attributes and uses pop-up windows combined with Service Workers for client-side exfiltration. The project highlights a practical attack vector that works even on sites protected against framing and XSS.
Security researchers, penetration testers, and web developers focused on understanding client-side vulnerabilities and CSS-based attack techniques. It's also relevant for those building or auditing web applications with CSRF protections.
This project provides a novel, documented method for CSS injection attacks that bypasses iFrame limitations, offering a realistic demonstration of how CSRF tokens can be stolen entirely client-side. It serves as an educational tool to raise awareness about the risks of rendering untrusted CSS.
Overview
Stealing CSRF tokens with CSS injection (without iFrames)
Use Cases
Best For
- Understanding CSS injection vulnerabilities beyond traditional XSS
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.