Test for HTML Injection Vulnerabilities

Provides a structured methodology for identifying and demonstrating HTML injection vulnerabilities - where unsanitized user input is reflected into a page as renderable HTML - covering discovery, payload construction, phishing and defacement proof-of-concept, filter-bypass techniques, automated testing, and remediation. It is explicitly scoped to authorized security assessments, defensive validation, or controlled educational environments only.

Use only for authorized security assessments, defensive validation, or controlled educational environments per the skill's own banner. It is built to identify injection points across search bars, comment sections, profile fields, forms, reflected URL parameters, error messages, and cookie values, then demonstrate impact (defacement, phishing) and produce remediation guidance - not for testing systems without authorization.

Deliverables: a vulnerability report of identified injection points, exploitation proof demonstrating content manipulation, an impact assessment covering phishing/defacement risk, and remediation guidance.

The methodology distinguishes HTML injection from XSS (only tags render vs. JavaScript executing) and walks through: mapping injection surfaces and common vulnerable parameters (?name=, ?search=, ?redirect=, etc.); basic testing with simple tags (<h1>, <b>, styled <div>, <a>, ``) via curl against target endpoints; the four injection types - stored (persisted in a database field like a bio or comment), reflected GET (URL parameters), reflected POST (form data), and URL-based (injected into a displayed URL/path); phishing construction (full-page fake login overlays posting credentials to an attacker-controlled endpoint, hidden credential-stealing forms); defacement payloads (full-page overlays, content replacement, marquee/image injection); advanced techniques (CSS injection for tracking/hiding content, meta-refresh redirects, form action hijacking, iframe embedding); and filter-bypass techniques (case variation, HTML-entity/URL/double/Unicode encoding, tag splitting, null bytes, attribute-based triggers like onmouseover).

Automated testing is covered via Burp Suite Intruder (mark the parameter as payload position, load an HTML injection wordlist, filter responses for rendered HTML), OWASP ZAP (spider plus active scan with HTML injection rules), and a custom Python fuzzing script that requests each payload URL-encoded and flags full or partial reflection in the response.

Remediation guidance covers output escaping per language - PHP's htmlspecialchars()/strip_tags(), Python's html.escape() and Jinja2 auto-escaping (warning against | safe), and JavaScript's safe textContent versus dangerous innerHTML (with DOMPurify.sanitize() as the safe path when HTML must be inserted) - plus server-side protections: input whitelisting, context-aware output encoding, CSP headers, and WAF rules.

A severity note: HTML injection ranks lower than XSS since no script executes, but impact rises sharply when combined with phishing forms or when reputational/defacement damage is considered.

Security testers and defenders conducting authorized web application assessments who need a structured HTML injection testing methodology - injection point discovery, proof-of-concept payloads, automated fuzzing, and matching remediation guidance per language/framework.