dangling-markup-injection

Dangling markup injection exfiltrates CSRF tokens in JavaScript-blocked scenarios by utilizing unclosed HTML tags to capture subsequent page content. This technique bypasses strict Content Security Policy restrictions without executing scripts.

Dangling markup injection is an HTML injection technique using unclosed tags to capture sensitive page content. It works by leaving attributes open so subsequent page data is absorbed into the attacker's payload for exfiltration.

You can use image tags, form action hijacks, base tag hijacks, and meta refresh redirects as exfiltration vectors. These methods steal session data and pre-filled form values without relying on JavaScript execution.

Different browsers handle dangling markup in specific ways, affecting how unclosed tags consume subsequent page content. Understanding these browser-specific behaviors is crucial for successful HTML injection and data exfiltration.

Using dangling markup injection requires knowledge of HTML and browser behavior. The target application must have an HTML injection vulnerability where JavaScript execution is explicitly blocked by content security policies.

Use textarea and form combos or comment and style dangling for advanced selective consumption of page content. These strategies provide better control over what sensitive data is captured compared to standard image tag exfiltration vectors.