dangling-markup-injection

Name: dangling-markup-injection
Availability: InStock
Author: doriangallo

Exfiltrate sensitive page data via dangling HTML markup injection.

5|2|Updated May 16, 2026

Search Tags:#csp #web security #data exfiltration #html injection #xss mitigation bypass #csrf token theft #browser parsing

Ready to run

npx skills add https://github.com/DorianGallo/hack-skills-local --skill dangling-markup-injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dangling-markup-injection
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/dangling-markup-injection
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill dangling-markup-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Dangling markup injection helps you steal sensitive page data even when classic XSS is blocked by CSP or sanitizers that remove script execution.

Core Features & Use Cases

HTML injection exfiltration without JavaScript: Use unclosed tags to force the browser to load attacker-controlled URLs that include captured content.
Context- and browser-aware vectors: Choose tag types and quote contexts to maximize what gets consumed and exfiltrated across Chrome/Firefox/Safari differences.
Data targeting for real apps: Focus on CSRF tokens, pre-filled form values, session identifiers, and other secrets present after the injection point.
Amplification and chaining: Pair with CSRF, open redirects, and cache deception to increase impact when needed.

Quick Start

Use the dangling-markup-injection skill to identify an HTML injection point on a page where secrets appear after it, then select a CSP-compliant dangling tag vector that forces the browser to send those secrets to a controlled endpoint.

Frequently Asked Questions about dangling-markup-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exfiltrate data when CSP blocks JavaScript execution?▼

Dangling markup injection exfiltrates data by injecting unclosed HTML tags that force the browser to load attacker-controlled URLs containing captured page content. It bypasses CSP script restrictions by leveraging browser parsing of unclosed markup rather than executing JavaScript.

What is dangling markup injection and how does it steal CSRF tokens?▼

Dangling markup injection is an HTML injection technique that captures secrets appearing after the injection point, like CSRF tokens and hidden form fields. It uses unclosed tags to consume subsequent page content and send it to an external endpoint.

Can I use HTML injection to steal pre-filled form values across different browsers?▼

Yes, you can use context- and browser-aware dangling tag vectors to steal pre-filled form values. You must select appropriate tag types and quote contexts to maximize consumed content across Chrome, Firefox, and Safari parsing differences.

What CSP bypasses are needed for dangling markup data exfiltration?▼

Appropriate CSP bypasses for dangling markup include exploiting form-action, base-uri, or meta refresh directives. These allow the injected HTML to successfully redirect or submit captured data to your controlled endpoint despite active policy restrictions.

Why does the img src vector not work for dangling markup in Chrome?▼

Chrome implements specific browser mitigations that block dangling markup exfiltration via img src tags. You must understand these browser-specific limitations and select alternative suitable dangling tags and quote contexts to successfully capture data.