It's quite possible. The trick they've used to prevent this attack involves disabling CSS on the :visited
selector. However, that doesn't stop the selector from still being there!
You can use JavaScript to iterate through a set of links, checking for the :visited
selector on each. It's possible to do the check using cssRules
, which should tell you which rules are being applied to a DOM element. Once you've found the visited ones, you can do an Ajax post back onto the site to store the results. There's a proof of concept of this trick, though there's no guarantee of it being correct and functional across all browsers.