Collection19 vectors
CSS the bomb inside your inbox
This collection is all the vectors I used for my research CSS:the bomb inside your inbox. You can read about the research when released here: portswigger.net/research/css-the-bomb-inside-your-…
Vectors1.Characters allowed as CSS variable names2.Characters allowed after !3.Invalid selector characters4.Invalid selector characters with a prefix of x5.Characters allowed before @import6.Characters allowed before url function with @import7.SVG elements & attributes that make external requests8.Characters before CSS property names9.CSS Properties that make external requests10.CSS Properties and functions that make external requests11.Characters allowed before image-set function12.Characters that close an @x prefix before @import13.Characters that close an @x with curlies prefix before @import14.CSS escapes that cause an external request with a forward slash15.CSS hex escapes that cause an external request in-between forward slashes16.Escaped characters that cause an external request in-between forward slashes17.CSS class name separators18.Characters before a CSS background url function19.Characters that break CSS dangling strings
