The tag has no usage guidance.

learn more… | top users | synonyms

9
votes
2answers
57 views

Personal stylesheets

In reference to this question, I was researching whether or not there would be any security risks in letting users add their own stylesheets. He brings up a scenario in which a dev might use ...
0
votes
1answer
71 views

Techniques for accessing hidden content on a web page [closed]

If content is hidden on a web page using a CSS hidden directive (consider this example of hiding the Sharepoint 2013 Share button with CSS). What techniques allow the user to circumvent that and ...
21
votes
2answers
2k views

Does this CSS code expose if a message is read, and how long they have been reading it?

This email analytics company offers an 'engagement metric' that shows how much time someone spends looking at an email, whether the email is printed or deleted. They also claim it works in pretty ...
1
vote
0answers
33 views

Is it dangerous to allow users to edit the CSS styles? [duplicate]

I'm working on a blog site, and I plan to allow bloggers to completely edit the style sheet for their own blogs I assume this isn't dangerous, since CSS is client side, but I thought it'd be best to ...
1
vote
3answers
205 views

Is a normal user allowed to view site's CSS sheet

I am looking at IDS (intrusion detection sensor) logs where some one tired to get a .css sheet through a URL. Ex: www.site.com/CSS/Main.css - which throws a CSS sheet in the form of text file. Is ...
1
vote
2answers
369 views

CAPTCHAs: How does simple math in cleartext prove you're human?

I'm intrigued that many sites use seemingly random numbers with a random operator as a security check to validate that you're not a bot. Forgive my ignorance in captcha technology, but what is ...
5
votes
3answers
2k views

Can CSS file contain malware? [duplicate]

I know that javascript files can contain malware. However, I am not so sure about CSS files. They only affect how the page is displayed, right? I know that css files can be used for clickjacking but I ...
-3
votes
1answer
99 views

Feedback Form Exploitation possible or not? [closed]

how an attacker can exploit the below provided feedback form in a company website containing the company’s domain? the feedback form does not store data into a database. The server side code only ...
1
vote
2answers
310 views

Identify users accessing hidden link in a website

Recently I put some hidden links in a web site in order to trap web crawlers. (Used CSS visibility hidden style in order to avoid human users accessing it). Any way, I found that there were plenty of ...
4
votes
1answer
3k views

Calling JavaScript functions from within a Style tag XSS

I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
4
votes
2answers
195 views

To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles?

I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent ...
24
votes
1answer
1k views

CSS based attacks

I'm currently working on a plugin for a CMS which should allow content editors to write inline style tags. I'm looking for advice / links on how inline styles could be abused. Part of the reason ...