dangling-markup-injection

Detect dangling markup injection to exfiltrate CSRF tokens and session data.

Updated Jun 11, 2026

Search Tags:#HTML injection #CSP bypass #dangling markup #CSRF token extraction #session exfiltration

Ready to run

npx skills add https://github.com/utsavthakur/agenticskills --skill dangling-markup-injection-utsavthakur

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dangling-markup-injection
Source: https://github.com/utsavthakur/agenticskills/tree/main/dangling-markup-injection
Command: npx skills add https://github.com/utsavthakur/agenticskills --skill dangling-markup-injection-utsavthakur

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill is designed to address situations where HTML injection is possible but JavaScript execution is blocked, allowing exfiltration of sensitive data such as CSRF tokens and session information.

Core Features & Use Cases

Dangling Markup Injection: Exploit unclosed HTML tags to exfiltrate data without JavaScript.
CSRF Token Extraction: Steal CSRF tokens for potential CSRF attacks.
Session Data Exfiltration: Extract sensitive session data from web pages.
Use Case: For example, you can use this skill to extract CSRF tokens from a website when JavaScript execution is blocked due to Content Security Policies (CSP) or other security measures.

Quick Start

Use the dangling-markup-injection skill to extract CSRF tokens from the target web page.

Frequently Asked Questions about dangling-markup-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is dangling markup injection and how does it exfiltrate data without JavaScript?▼

Dangling markup injection is a technique that uses unclosed HTML tags to exfiltrate sensitive data like CSRF tokens from web pages, bypassing security measures that block JavaScript execution such as strict Content Security Policies.

How do I extract CSRF tokens when Content Security Policy blocks script execution?▼

To extract CSRF tokens when CSP blocks script execution, you can utilize dangling markup injection by injecting unclosed HTML tags that capture the token data and route it to an external endpoint without requiring JavaScript execution.

Can I use dangling markup injection for session data exfiltration on secure web pages?▼

Yes, you can use dangling markup injection for session data exfiltration on secure web pages where HTML injection is possible but JavaScript is blocked, allowing you to extract sensitive session identifiers through browser-rendered HTML.

Does HTML injection work to bypass Content Security Policy restrictions?▼

HTML injection can bypass Content Security Policy restrictions that specifically block JavaScript execution. By leveraging unclosed HTML tags, attackers can exfiltrate data without triggering script-based CSP violations.

What are the limitations of dangling markup injection for data exfiltration?▼

The primary limitation of dangling markup injection is that it requires an existing HTML injection vulnerability. Additionally, it cannot execute complex logic and may be mitigated by modern browser security mechanisms that block cross-origin data leakage.

When should I use dangling markup injection instead of traditional cross-site scripting?▼

You should use dangling markup injection instead of traditional cross-site scripting when the target web page blocks JavaScript execution through Content Security Policies, but still permits HTML injection, allowing CSRF token and session data extraction.

naporin0624

form-security-analyzer

Analyzes HTML forms for CSRF tokens, insecure actions, missing validation, hidden field exposure and misconfigurations, generating text or JSON reports.

Community

Intermediate