dangling-markup-injection

Dangling markup injection is a technique that uses unclosed HTML tags to exfiltrate sensitive data like CSRF tokens from web pages, bypassing security measures that block JavaScript execution such as strict Content Security Policies.

To extract CSRF tokens when CSP blocks script execution, you can utilize dangling markup injection by injecting unclosed HTML tags that capture the token data and route it to an external endpoint without requiring JavaScript execution.

Yes, you can use dangling markup injection for session data exfiltration on secure web pages where HTML injection is possible but JavaScript is blocked, allowing you to extract sensitive session identifiers through browser-rendered HTML.

HTML injection can bypass Content Security Policy restrictions that specifically block JavaScript execution. By leveraging unclosed HTML tags, attackers can exfiltrate data without triggering script-based CSP violations.

The primary limitation of dangling markup injection is that it requires an existing HTML injection vulnerability. Additionally, it cannot execute complex logic and may be mitigated by modern browser security mechanisms that block cross-origin data leakage.

You should use dangling markup injection instead of traditional cross-site scripting when the target web page blocks JavaScript execution through Content Security Policies, but still permits HTML injection, allowing CSRF token and session data extraction.