RetroFed Forums
Your home away from modern life.
Search Categories Forum list Register Log in
About RetroFed
RetroFed

Welcome to the nostalgia-filled piefed instance of yesteryear.

Open Registration with Application questionnaire.

If you have a question or comment you can post in !meta@retrofed.com or message @DosDude@retrofed.com or @Die4Ever@retrofed.com

In case of downtime and/or emergency, we will post updates on @DosDude@mastodon.social

Some rules we try to uphold:

  • Be civil. Bigotry is not welcome. This includes (but is not limited to): transphobia, queerphobia, racism, ageism and ableism. We do not promote hate.
  • Communities need to be Retro or Retro-adjacent.
  • Please don't upload pornographic content. (use an external image host for that)
72 registered users
Administrators: DosDude, Die4Ever
Visit retrofed.com
Smashing the token limit with overlapping fragments
Post Reply RetroFed Forums Forum Index » CSS
AuthorMessage
codeinabox
programming.dev

codeinabox@programming.dev
Joined: 2025-09-29
Posted:   Subject: Smashing the token limit with overlapping fragments Quote

Link: https://portswigger.net/research/smashing-the-token-limit

When Gareth previewed CSS: the bomb inside your inbox I was blown away. He could steal a login token with CSS alone, without having to recursively load another stylesheet for every character. Then I watched the browser wrestle with roughly 250 MB of CSS to recover a 12-character hex token. It worked. But such a large payload for 12 characters made me think there must be a better way.
6   Original
Post Reply
Back to top
Powered by RetroFed · PieBB frontend · All times are Europe/Amsterdam