People are missing the point of the story (and the title doesn’t help)
CSS here is only used to hide the URL from security checkers, but a JavaScript part is still needed.
CSS alone can’t run scripts nor send the content of an input field.
CSS here is only used to hide the URL from security checkers, but a JavaScript part is still needed.
CSS alone can’t run scripts nor send the content of an input field.
No it's not, it's just rare that you'd have the ability to inject CSS but not JS.
A core skill of hacking is being able to see through the things people would normally see as "hassle" or "friction" to the reductionist "what keys do I have to press on the machine in what order to make this happen".
For credit card numbers that means that you’ll miss at least 4 digits and you won’t know their position among 16. I’m not gonna do the math but that’s a few times more than 10000 guesses necessary to find the final number.
Yeah, the problem isn't CSS, them problem is whoever thought that was a good idea. Now XSS is a "feature" of CSS.