{"id":"hunt-html-injection","name":"hunt-html-injection","summary":"Hunt HTML Injection — ユーザー入力はサニタイズなしで応答中に生のHTMLとしてレンダリングされるため、攻撃者は任意のHTMLタグ(必ずしもJavaScriptではない)を注入できます。","body":"## What is HTML Injection\n\nHTML Injection occurs when user input is inserted into a page's HTML without escaping, so injected tags are rendered by the browser as markup rather than displayed as literal text. Unlike XSS, the injected content does not require JavaScript execution — injecting `<b>`, `<h1>`, `<a>`, `<img>`, or `<form>` tags is sufficient.\n\n**To PROVE impact unambiguously, escalate to an active vector carrying a unique numeric canary** — e.g. `\"><img src=x onerror=alert(91234)>` or `<svg onload=alert(91234)>`. A distinctive 4+ digit number (not `alert(1)`) distinguishes YOUR reflected injection from the example payloads practice pages embed in their own hint text. Proof = the raw, unescaped vector with your canary appears in the response.\n\n**Impact:**\n- Phishing via injected `<form>` or `<a href=\"attacker.com\">` tags\n- UI defacement — `<h1>HACKED</h1>` renders visually on the page\n- Credential harvesting via injected login forms\n- Redirect via `<meta http-equiv=\"refresh\">`\n- Stepping stone to XSS (may be blocked by WAF on `<script>` but not `<img onerror>`)\n\n## Attack Surface\n\nAny input that is reflected or stored and then displayed in an HTML context:\n- Search boxes (`?q=`)\n- Comments, feedback, reviews\n- Profile fields (name, bio, username)\n- Error messages (`?error=`, `?message=`)\n- Subject / body of contact forms\n- Admin-visible fields (ticket titles, usernames in logs)\n\n## Autonomous Testing Priority\n\n**Inject a recognisable HTML tag with a unique canary string. Unescaped angle brackets in the response = confirmed injection.**\n\n**Pattern 1 — Basic HTML tag injection:**\n```\n<b>CANARY</b>\n\"><b>CANARY</b>\n```\nUse a unique string as CANARY (something distinct to this test run). **Proof:** the response contains `<b>CANARY` with literal `<` angle brackets — not `&lt;b&gt;CANARY`. A properly encoded app would escape `<` to `&lt;`.\n\n**Try multiple tag types when `<b>` is filtered:**\n- `<h1>CANARY</h1>` — heading tag (often less filtered)\n- `<img src=x onerror=CANARY>` — attribute context\n- `<a href=\"https://attacker.com\">click</a>` — link injection (phishing proof)\n\n**For stored injection:** inject into the storage endpoint, then GET the page where the value is displayed and check for unescaped tags.\n\n**Escalate immediately:** if `<b>` injection works, try `<script>alert(1)</script>` — the same unsanitised input may allow full XSS.\n\n## Proof\n\nConfirmed when your injected tag appears in the response body with literal `<` angle brackets (not HTML-encoded). A safe app renders `&lt;b&gt;CANARY&lt;/b&gt;`; a vulnerable app renders `<b>CANARY</b>`.\n\n## Distinguishing HTML Injection from XSS\n\n- HTML injection: `<b>text</b>` renders as **text** in the browser — no JS execution needed.\n- XSS: `<script>alert(1)</script>` executes JavaScript.\n\nSome WAFs block `<script>` but pass `<b>` or `<img>` — start with non-script tags, then escalate.","author":"@elementalsouls","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-html-injection","license":"MIT","category":"design","lang":"en","tokens":733,"stars":0,"calls30d":1,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":["attacker.com"]}}