Smashing the token limit with overlapping fragments
Summary: PortSwigger researcher Alex showed that overlapping short CSS fragments can be stitched back into long tokens, recovering a 12-character hex token with a 223,365-byte stylesheet (4,128 selectors) and a 1,334,437-byte sheet (25,088 selectors) that left one candidate in 99,114 of 100,000 test runs. Spending Gareth Heyes's original 257,691,933-byte CSS budget instead, the method reconstructed tokens of 210 hex characters with one guess in 29,753 of 30,000 URLs and 640 characters with up to five candidates in 27,158 of 30,000.
What you should know: A single stylesheet of roughly 257 MB, no recursive imports required, can now recover tokens hundreds of characters long, so any CSS injection that was dismissed because it could not chain imports deserves a second look.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026