diff --git a/pentesting-web/xs-search/css-injection/README.md b/pentesting-web/xs-search/css-injection/README.md index f2ba14adc..e18e5ccc9 100644 --- a/pentesting-web/xs-search/css-injection/README.md +++ b/pentesting-web/xs-search/css-injection/README.md @@ -97,6 +97,12 @@ Sometimes the script **doesn't detect correctly that the prefix + suffix discove No worries, just check the **output** because **you can see the flag there**. {% endhint %} +### Other selectors + +Other ways to access DOM parts with **CSS selectors**: + +* **`.class-to-search:nth-child(2)`**: This will search the second item with class "class-to-search" in the DOM. + ### Error based XS-Search **Reference:** [CSS based Attack: Abusing unicode-range of @font-face ](https://mksben.l0.cm/2015/10/css-based-attack-abusing-unicode-range.html), [Error-Based XS-Search PoC by @terjanq](https://twitter.com/terjanq/status/1180477124861407234)