Smashing the Token Limit with Overlapping Fragments

[carlospolop]

Blog URL

https://portswigger.net/research/smashing-the-token-limit

Blog Title

Smashing the Token Limit with Overlapping Fragments

Blog high summary

Overview and impact: The post presents an advanced blind CSS exfiltration technique that extends Gareth Heyes's earlier CSS-only token theft. If an attacker can inject CSS into a page that renders a secret in a link, attribute, or form value, the stylesheet can test whether candidate character fragments occur anywhere in that value. The oracle reveals presence but not position,…

Blind CSS substring oracle: When an attacker can inject CSS into a page that renders a secret in an href, hidden input, meta element, data attribute, input value, title attribute, form action, or button attribute, candidate substrings can be tested through CSS matching and observable reporting side effects. Each positive result reveals only that the fragment exists somewhere in the…

PR changes

• src/pentesting-web/xs-search/css-injection/README.md: Added single-stylesheet fragment reconstruction, ambiguity checks, selector-budget guidance, and alphabet-adaptive Burp AT usage, with links to existing start/end and hidden-element techniques.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

Graph-based reconstruction and selective longer-fragment checks extend the book’s existing 12-character, single-middle-fragment technique. The benchmark figures were corrected against the original research. The canonical CSS injection page, references, heading links, and final diff were checked. mdBook was not run, as required by the review policy.

Head: 812ca1ae20a212b0590a0c22e700e1b966eb9091

[carlospolop]

merge