In this post, I would like to share about new CSS based attack with unicode-range descriptor of @font-face rule. Using this technique, an attacker can read page's text partially by CSS only. An attacker might use this technique in the following cases: - Browser's XSS filter bypass (e.g. XSS Auditor does not block <style> injection) - Only CSS injection is allowed in the target page As far as I kno
![CSS based Attack: Abusing unicode-range of @font-face](https://cdn-ak-scissors.b.st-hatena.com/image/square/de33d176788de92423c6515bf8ce15c2d774f747/height=288;version=1;width=512/https%3A%2F%2Fblogger.googleusercontent.com%2Fimg%2Fb%2FR29vZ2xl%2FAVvXsEhhvloLF4w8TJLH4r-iyuQHS4i3iSPoHUVE82yXTKqZvuUDTKnVelkVz7jdGInqgg-QdZRfMujnK3cIq-30X-xfA5DLhwRYZeQrRWKliXSMHH4W8_UpjZZF7Riqo_HqP3YVpeKFOoBbdz0%2Fw1200-h630-p-k-no-nu%2Funicode-range.png)