#csskeylogger#cssinjection#scriptlessattacks
949K subscribers • 15 videos on Hallway
Intermediate. Assumes working knowledge.
314K views8 years ago1 recommendation
SecurityWeb developmentWeb and application securityExploits and vulnerabilitiesCSS and layout
LiveOverflow explains how attackers can use CSS attribute selectors to log user inputs without JavaScript.
This is "well known" research that resurfaces every other year. Let me tell you a story how I have heard about this in 2012 and putting it into perspective. LEARN ON HEXTREE (ad) Learn hacking on Hextree: hextree.io/ Watch this video and more on Hextree: app.hextree.io/courses/yt-xss/related-client-side-hacks Join the Hextree Discord: discord.gg/xgQpCQCpvy Research "Scriptless Attacks – Stealing the Pie Without Touching the Sill" (2012): + Paper: nds.rub.de/media/emma/veroeffentlichungen/2012/08/16/scriptl… + Slides: slideshare.net/x00mario/stealing-the-pie + Talk recording: channel9.msdn.com/Events/Blue-Hat-Security-Briefings/BlueHat… CSS Keylogger: github.com/maxchehab/CSS-Keylogging Stealing Data With CSS - Attack and Defense: mike-gualtieri.com/posts/stealing-data-with-css-attack-and-d… Twitter: + twitter.com/0x6D6172696F + twitter.com/sirdarckcat + twitter.com/garethheyes + twitter.com/thornmaker + twitter.com/mlgualtieri CHAPTERS - The Viral CSS Keylogger and a 2012 Memory - Scriptless Attacks as a Research Thought Experiment - Extracting Data Without JavaScript - Leaking Attribute Values With CSS Background Requests - The 2018 Rediscovery and Earlier Research - How the CSS Keylogger Example Works and Where It Fails - JavaScript Frameworks Mirror Input Properties to Attributes - Why Rediscovering Old Research Still Has Value - Putting the “Keylogger” Name and Impact Into Perspective - Rare Attack Surface, Low Risk and Useful Research SUPPORT Per video: patreon.com/join/liveoverflow Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join Buy my handwriting font (ad): shop.liveoverflow.com/ WATCH, FOLLOW & READ Second channel: youtube.com/LiveUnderflow Twitch: twitch.tv/LiveOverflow/ Twitter: twitter.com/LiveOverflow/ Instagram: instagram.com/LiveOverflow/ TikTok: tiktok.com/@liveoverflow_ LiveOverflow blog: liveoverflow.com/ Hextree blog (ad): hextree.io/blog #SecurityResearch (ad) LiveOverflow YouTube channel is supported by advertisement and product placement.What people say. Cited as an explanation of how CSS injection can be used to keylog user inputs.
u/MrRobotjsin r/programming • Recommends
On “Google will now pay up to $30,000 for reporting a Chrome bug”