HTML Injection Testing

HTML Injection Testing

Identify and exploit HTML injection vulnerabilities that allow attackers to inject malicious HTML content into web applications. This vulnerability enables attackers to modify page appearance, create phishing pages, and steal user credentials through injected forms.

When to Use

• This skill is applicable to execute the workflow or actions described in the overview.

Core Workflow

1. Confirm the request matches this skill's trigger, scope, and risk profile.
2. Use the topic map to identify the relevant pattern, checklist, or example before writing detailed guidance or code.
3. Load references/full-guidance.md when implementation details, examples, anti-patterns, validation checks, or edge cases are needed.
4. Apply only the relevant guidance instead of loading or repeating the entire reference by default.
5. Verify the result against any validation checks, limitations, security notes, or platform constraints in the reference.

Topic Map

• Purpose
• Prerequisites
• Required Tools
• Required Knowledge
• Outputs and Deliverables
• Core Workflow
• Phase 1: Understanding HTML Injection
• Phase 2: Identifying Injection Points
• Phase 3: Basic HTML Injection Testing
• Phase 4: Types of HTML Injection
• Phase 5: Phishing Attack Construction
• Phase 6: Defacement Payloads
• Phase 7: Advanced Injection Techniques
• Phase 8: Bypass Techniques
• Phase 9: Automated Testing
• Phase 10: Prevention and Remediation
• Quick Reference
• Common Test Payloads

Reference Map

• references/full-guidance.md preserves the complete original guidance, including examples and detailed edge cases.

Progressive Loading

Keep this SKILL.md as the compact routing and workflow entrypoint. Load the reference file only when the user task requires the deeper implementation material.