CSS-Based Redirection

In March 2009, I published an unorthodox technique demonstrating page redirection without embedding any discernible <script> tags within the HTML document payload.

The architectural question was straightforward: can a web browser be compelled to execute arbitrary JavaScript purely via declarative CSS stylesheet properties?

The answer was yes, leveraging two proprietary technologies natively supported by the two dominant browsers of the era (Mozilla Firefox and Microsoft Internet Explorer), which combined represented over 90% of global web traffic.

The attack topology split execution across three lightweight files:

Within index.html, the document embedded a seemingly benign CSS declaration block:

<style>
body {
  behavior: url("./redirect.htc");
  -moz-binding: url('./redirect.xml#redirect');
}
</style>

For clients running Mozilla Firefox, the proprietary -moz-binding property referenced redirect.xml (authored in XBL, XML Binding Language), binding an executable constructor to the window load event:

<?xml version="1.0"?>
<bindings xmlns="http://www.mozilla.org/xbl" xmlns:html="http://www.w3.org/1999/xhtml">
  <binding id="redirect" applyauthorstyles="false">
    <implementation>
      <constructor>
        window.addEventListener('load', function() {
          location.href = 'https://kerouac3001.com';
        }, false);
      </constructor>
    </implementation>
  </binding>
</bindings>

For clients running Internet Explorer, the behavior directive loaded redirect.htc (HTML Component), invoking JScript upon the ondocumentready lifecycle trigger:

<attach event="ondocumentready" handler="redirect" />
<script language="JScript">
function redirect() {
  window.document.location.href = 'https://kerouac3001.com';
}
</script>

This technique proved remarkably effective at evading contemporary anti-spam filters:

• Crawler parsers screened for meta redirects (<meta http-equiv="refresh">), inline <script> tags, or HTTP status headers (301/302).
• Stylesheets were treated as passive presentation directives: virtually no production indexing bot retrieved or parsed auxiliary XML/HTC definitions declared within CSS properties.

In modern web architectures, both mechanisms have been completely eradicated: XBL was formally excised from Mozilla's Gecko engine, and HTC vanished with the retirement of Internet Explorer. Modern defenses rely on strict Content Security Policy (CSP) headers, enforcing cryptographic nonces and banning script execution through external style bindings.