hunt-html-injection

Name: hunt-html-injection
Author: elementalsouls

3.0kstars461forks

How to install hunt-html-injection?

elementalsouls/claude-bughunter/hunt-html-injection

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-html-injection

Installs into the current project.

Summary

Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but not necessarily JavaScript). Lower severity than XSS but enables phishing, UI manipulation, and credential harvesting vi

Files · 1

View on GitHub

SKILL.md

1	## What is HTML Injection
2
3	HTML Injection occurs when user input is inserted into a page's HTML without escaping, so injected tags are rendered by the browser as markup rather than displayed as literal text. Unlike XSS, the injected content does not require JavaScript execution — injecting `<b>`, `<h1>`, `<a>`, `<img>`, or `<form>` tags is sufficient.
4
5	To PROVE impact unambiguously, escalate to an active vector carrying a unique numeric canary — e.g. `"><img src=x onerror=alert(91234)>` or `<svg onload=alert(91234)>`. A distinctive 4+ digit number (not `alert(1)`) distinguishes YOUR reflected injection from the example payloads practice pages embed in their own hint text. Proof = the raw, unescaped vector with your canary appears in the response.
6
7	Impact:
8	- Phishing via injected `<form>` or `<a href="attacker.com">` tags
9	- UI defacement — `<h1>HACKED</h1>` renders visually on the page
10	- Credential harvesting via injected login forms
11	- Redirect via `<meta http-equiv="refresh">`
12	- Stepping stone to XSS (may be blocked by WAF on `<script>` but not `<img onerror>`)
13
14	## Attack Surface
15
16	Any input that is reflected or stored and then displayed in an HTML context:
17	- Search boxes (`?q=`)
18	- Comments, feedback, reviews
19	- Profile fields (name, bio, username)
20	- Error messages (`?error=`, `?message=`)
21	- Subject / body of contact forms
22	- Admin-visible fields (ticket titles, usernames in logs)
23
24	## Autonomous Testing Priority
25
26	Inject a recognisable HTML tag with a unique canary string. Unescaped angle brackets in the response = confirmed injection.
27
28	Pattern 1 — Basic HTML tag injection:
29	```
30	<b>CANARY</b>
31	"><b>CANARY</b>
32	```
33	Use a unique string as CANARY (something distinct to this test run). Proof: the response contains `<b>CANARY` with literal `<` angle brackets — not `<b>CANARY`. A properly encoded app would escape `<` to `<`.
34
35	Try multiple tag types when `<b>` is filtered:
36	- `<h1>CANARY</h1>` — heading tag (often less filtered)
37	- `<img src=x onerror=CANARY>` — attribute context
38	- `<a href="https://attacker.com">click</a>` — link injection (phishing proof)
39
40	For stored injection: inject into the storage endpoint, then GET the page where the value is displayed and check for unescaped tags.
41
42	Escalate immediately: if `<b>` injection works, try `<script>alert(1)</script>` — the same unsanitised input may allow full XSS.
43
44	## Proof
45
46	Confirmed when your injected tag appears in the response body with literal `<` angle brackets (not HTML-encoded). A safe app renders `<b>CANARY</b>`; a vulnerable app renders `<b>CANARY</b>`.
47
48	## Distinguishing HTML Injection from XSS
49
50	- HTML injection: `<b>text</b>` renders as text in the browser — no JS execution needed.
51	- XSS: `<script>alert(1)</script>` executes JavaScript.
52
53	Some WAFs block `<script>` but pass `<b>` or `<img>` — start with non-script tags, then escalate.

People who liked this also viewed

6 picks

Type

hunt-html-injection

3.0kstars461forks

View on GitHub

How to install hunt-html-injection?

elementalsouls/claude-bughunter/hunt-html-injection

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-html-injection

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## What is HTML Injection
2
3	HTML Injection occurs when user input is inserted into a page's HTML without escaping, so injected tags are rendered by the browser as markup rather than displayed as literal text. Unlike XSS, the injected content does not require JavaScript execution — injecting `<b>`, `<h1>`, `<a>`, `<img>`, or `<form>` tags is sufficient.
4
5	To PROVE impact unambiguously, escalate to an active vector carrying a unique numeric canary — e.g. `"><img src=x onerror=alert(91234)>` or `<svg onload=alert(91234)>`. A distinctive 4+ digit number (not `alert(1)`) distinguishes YOUR reflected injection from the example payloads practice pages embed in their own hint text. Proof = the raw, unescaped vector with your canary appears in the response.
6
7	Impact:
8	- Phishing via injected `<form>` or `<a href="attacker.com">` tags
9	- UI defacement — `<h1>HACKED</h1>` renders visually on the page
10	- Credential harvesting via injected login forms
11	- Redirect via `<meta http-equiv="refresh">`
12	- Stepping stone to XSS (may be blocked by WAF on `<script>` but not `<img onerror>`)
13
14	## Attack Surface
15
16	Any input that is reflected or stored and then displayed in an HTML context:
17	- Search boxes (`?q=`)
18	- Comments, feedback, reviews
19	- Profile fields (name, bio, username)
20	- Error messages (`?error=`, `?message=`)
21	- Subject / body of contact forms
22	- Admin-visible fields (ticket titles, usernames in logs)
23
24	## Autonomous Testing Priority
25
26	Inject a recognisable HTML tag with a unique canary string. Unescaped angle brackets in the response = confirmed injection.
27
28	Pattern 1 — Basic HTML tag injection:
29	```
30	<b>CANARY</b>
31	"><b>CANARY</b>
32	```
33	Use a unique string as CANARY (something distinct to this test run). Proof: the response contains `<b>CANARY` with literal `<` angle brackets — not `<b>CANARY`. A properly encoded app would escape `<` to `<`.
34
35	Try multiple tag types when `<b>` is filtered:
36	- `<h1>CANARY</h1>` — heading tag (often less filtered)
37	- `<img src=x onerror=CANARY>` — attribute context
38	- `<a href="https://attacker.com">click</a>` — link injection (phishing proof)
39
40	For stored injection: inject into the storage endpoint, then GET the page where the value is displayed and check for unescaped tags.
41
42	Escalate immediately: if `<b>` injection works, try `<script>alert(1)</script>` — the same unsanitised input may allow full XSS.
43
44	## Proof
45
46	Confirmed when your injected tag appears in the response body with literal `<` angle brackets (not HTML-encoded). A safe app renders `<b>CANARY</b>`; a vulnerable app renders `<b>CANARY</b>`.
47
48	## Distinguishing HTML Injection from XSS
49
50	- HTML injection: `<b>text</b>` renders as text in the browser — no JS execution needed.
51	- XSS: `<script>alert(1)</script>` executes JavaScript.
52
53	Some WAFs block `<script>` but pass `<b>` or `<img>` — start with non-script tags, then escalate.

People who liked this also viewed

6 picks

Type