Member-only story
Easy ways to Exploit HTML Injection
HTML Injection is a critical vulnerability that poses significant risks to web applications, potentially leading to severe damage. To effectively assess and amplify the severity of an HTML Injection, follow these steps:
- Thoroughly examine all input fields within the web application. Input fields can harbor various vulnerabilities, including SQL Injections, Cross-Site Scripting (XSS), Server Side Template Injection (SSTI), and more.
- In scenarios where the application has protective measures against XSS attacks, it is worthwhile to explore HTML Injections as an alternative. HTML Injections can be equally destructive and should be thoroughly tested.
To test for HTML Injections, use the following method:
- Insert the following code within an input field:
"><h1>TEST </h1> - If the displayed output on the screen shows a large text with “TEST,” it signifies a successful HTML Injection.
However, it is important to note that such an injection may not demonstrate significant impact on its own. Although it allows for defacement of the web application, you can escalate this vulnerability further by utilizing the meta tag.
By injecting a meta tag, an attacker gains the capability to manipulate the web application’s behavior in unexpected ways. One particularly impactful manipulation involves the use of the meta tag to initiate a redirection to another website. Consider the following example payload that redirects…