The tag has no wiki summary.

learn more… | top users | synonyms

21
votes
2answers
1k views

Does this CSS code expose if a message is read, and how long they have been reading it?

This email analytics company offers an 'engagement metric' that shows how much time someone spends looking at an email, whether the email is printed or deleted. They also claim it works in pretty ...
1
vote
0answers
33 views

Is it dangerous to allow users to edit the CSS styles? [duplicate]

I'm working on a blog site, and I plan to allow bloggers to completely edit the style sheet for their own blogs I assume this isn't dangerous, since CSS is client side, but I thought it'd be best to ...
1
vote
3answers
189 views

Is a normal user allowed to view site's CSS sheet

I am looking at IDS (intrusion detection sensor) logs where some one tired to get a .css sheet through a URL. Ex: www.site.com/CSS/Main.css - which throws a CSS sheet in the form of text file. Is ...
1
vote
2answers
245 views

CAPTCHAs: How does simple math in cleartext prove you're human?

I'm intrigued that many sites use seemingly random numbers with a random operator as a security check to validate that you're not a bot. Forgive my ignorance in captcha technology, but what is ...
5
votes
3answers
1k views

Can CSS file contain malware? [duplicate]

I know that javascript files can contain malware. However, I am not so sure about CSS files. They only affect how the page is displayed, right? I know that css files can be used for clickjacking but I ...
-3
votes
1answer
91 views

Feedback Form Exploitation possible or not? [closed]

how an attacker can exploit the below provided feedback form in a company website containing the company’s domain? the feedback form does not store data into a database. The server side code only ...
1
vote
2answers
240 views

Identify users accessing hidden link in a website

Recently I put some hidden links in a web site in order to trap web crawlers. (Used CSS visibility hidden style in order to avoid human users accessing it). Any way, I found that there were plenty of ...
2
votes
1answer
2k views

Calling JavaScript functions from within a Style tag XSS

I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
4
votes
2answers
160 views

To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles?

I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent ...
22
votes
1answer
870 views

CSS based attacks

I'm currently working on a plugin for a CMS which should allow content editors to write inline style tags. I'm looking for advice / links on how inline styles could be abused. Part of the reason ...