In-app reader
Login
_ _
_ _ _ _ _
Products
Solutions
Research Academy
Support
Company
Customers About Blog Careers Legal Contact Resellers
My account Customers About Blog Careers Legal Contact Resellers
Burp AT Agentic AI that extends human-led pentesting.
Burp Suite DAST The enterprise-enabled dynamic web vulnerability scanner.
Burp Suite Professional The world's #1 web penetration testing toolkit.
Burp Suite Community Edition The best manual tools to start web security testing.
View all product editions
Burp Scanner
Burp Suite's web vulnerability scanner
Attack surface visibility Improve security posture, prioritize manual testing, free up time. CI-driven scanning More proactive security - find and fix vulnerabilities earlier. Application security testing See how our software enables the world to secure the web. DevSecOps Catch critical bugs; ship more secure software, more quickly.
Penetration testing Accelerate penetration testing - find more bugs, more quickly. Automated scanning Scale dynamic scanning. Reduce risk. Save time/money.
Bug bounty hunting Level up your hacking and earn more bug bounties. Compliance Enhance security monitoring to comply with confidence.
View all solutions
Product comparison
What's the difference between Pro and DAST?
Support Center Get help and advice from our experts on all things Burp. Documentation Tutorials and guides for Burp Suite. Get Started - Professional Get started with Burp Suite Professional. Get Started - DAST Get started with Burp Suite DAST. Downloads Download the latest version of Burp Suite.
Visit the Support Center
Downloads
Download the latest version of Burp Suite.
_
Articles
Overview
_
Core Topics
Black Hat XSS Request Smuggling Template Injection Top 10 Hacking Techniques
Articles
_
Meet the Researchers
James Kettle Gareth Heyes Zakhar Fedotkin Tom Stacey
Talks
RSS
_
_
Researcher
**Published: **Tuesday, 26 August 2025 at 12:54 UTC
**Updated: **Wednesday, 27 August 2025 at 07:35 UTC
I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below:
Someone asked if you could steal data using inline styles. I initially dismissed the idea but then I was reminded of Slonser's excellent technique of using the attr() and image-set() functions to steal data from the attribute. This method can steal an entire attribute provided you import a style sheet from your chosen domain. But this left me pondering what about without importing a stylesheet? Can you steal data just using inline styles?
CSS introduced if statements, that's right this (not a) programming language now has conditionals. I was sure I could use this as a way to check the attribute value and make a background request to any domain I like without requiring a stylesheet import. I began crafting a vector:
test
But it didn't work. Then Slonser sent a snippet that did work and it turned out the if statement comparison requires double not single quotes:
test
How quirky is CSS! I'm used to single and double quotes being interchangeable like JavaScript. So now we could make a request to an arbitrary domain using a background request and inline styles. The problem here is that you can only check one value but of course this (not a) programming language supports nested if statements! So you can chain them together and check for multiple values. This allows you to steal non-complex data such as user ids or usernames:
In the preceding example it can steal the data-uid attribute if it contains a value in the range of 1-10. So if you ever find yourself locked in a style attribute and need to steal the data of an attribute you can use our Custom Action in Burp Suite to brute force the required values! Note at the time of writing this technique only works on Chromium based browsers.
Here's a video demonstrating stealing usernames from the data-username attribute using a Burp Custom Action:
Here is the code used in the video:
Luke Jahnke pointed out you can make a background request without the url() syntax. A plain string will do. This means the vector can be reduced to:
test
CSS CSS injection Exfiltration
Back to all articles
CSS:the bomb inside your inbox
06 August 2026
CSS:the bomb inside your inbox
Splitting the email atom: exploiting parsers to bypass access controls
07 August 2024
Splitting the email atom: exploiting parsers to bypass access controls
Blind CSS Exfiltration: exfiltrate unknown web pages
05 December 2023
Blind CSS Exfiltration: exfiltrate unknown web pages
uBlock, I exfiltrate
Exploiting Ad blockers with CSS
06 December 2021
uBlock, I exfiltrate
Exploiting Ad blockers with CSS
Burp Suite
Web vulnerability scanner Burp Suite Editions Release Notes
Vulnerabilities
Cross-site scripting (XSS) SQL injection Cross-site request forgery XML external entity injection Directory traversal Server-side request forgery
Customers
Organizations Testers Developers
Company
About Careers Contact Legal Privacy Notice Modern Slavery Statement
Insights
Web Security Academy Blog Research Engineering
Follow us © 2026 PortSwigger Ltd.
Discussion
Sign in to join the discussion.
Keep reading
Optional: create a free account to save items, track programs, and sync across web + app. Reading stays free.