Bench Press: Leaking Text Nodes with CSS (2024)
10 hours ago
- #Text Node Leak
- #Client-Side Exploit
- #CSS Injection
- A new CSS technique to leak entire text nodes by measuring height differences through animations.
- Leaking authentication token via CSS injection using inline styles and remote images.
- Utilizing height measurement via animation timelines and unique font heights for characters.
- Iterative removal of letters using ::first-line and height difference calculation.
- Exfiltration of letters via paused animations and remote image URLs.
- Limitations include floating-point inaccuracies and Chrome-only features.
- Potential applications in client-side web exploits due to modern CSS capabilities.