Stealing CSRF tokens with CSS injection (without iFrames)github.com/dxa44812 pointschatmasta8 years ago