Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-15 09:27:32 +00:00
Code Issues Projects Releases Packages Wiki Activity

GitBook: [#3344] No subject

Browse source
This commit is contained in:
CPol 2022-08-01 23:17:26 +00:00 committed by gitbook-bot
parent 98318bd9f9
commit 729535edba
No known key found for this signature in database
GPG key ID: 07D2180C7B12D0FF
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
pentesting-web/xs-search/css-injection/README.md
View file

@ -97,6 +97,12 @@ Sometimes the script **doesn't detect correctly that the prefix + suffix discove
No worries, just check the **output** because **you can see the flag there**. No worries, just check the **output** because **you can see the flag there**.
{% endhint %} {% endhint %}
### Other selectors
Other ways to access DOM parts with **CSS selectors**:
* **`.class-to-search:nth-child(2)`**: This will search the second item with class "class-to-search" in the DOM.
### Error based XS-Search ### Error based XS-Search
**Reference:** [CSS based Attack: Abusing unicode-range of @font-face ](https://mksben.l0.cm/2015/10/css-based-attack-abusing-unicode-range.html), [Error-Based XS-Search PoC by @terjanq](https://twitter.com/terjanq/status/1180477124861407234) **Reference:** [CSS based Attack: Abusing unicode-range of @font-face ](https://mksben.l0.cm/2015/10/css-based-attack-abusing-unicode-range.html), [Error-Based XS-Search PoC by @terjanq](https://twitter.com/terjanq/status/1180477124861407234)