. Some WAFs block script tags but pass benign tags, so testers start with non-script payloads before escalating."}},{"@type":"Question","name":"Can HTML injection work when script tags are blocked by a WAF?","acceptedAnswer":{"@type":"Answer","text":"Yes, WAFs often filter

Verified:Website GitHub

hunt-html-injection

Detect HTML injection vulnerabilities by reflecting unsanitized markup in web application responses.

4.0k|628|Updated May 5, 2026

Search Tags:#XSS #penetration testing #web security #bug bounty #HTML injection #WAF bypass #Payload

One-click install

npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-html-injection

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: hunt-html-injection
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-html-injection
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-html-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web applications often render user-supplied input as raw HTML without escaping, enabling phishing, UI defacement, and credential harvesting. This Skill guides testers through systematically identifying and proving HTML injection flaws during authorized bug bounty and red-team engagements.

Core Features & Use Cases

Canary-Based Detection: Inject recognizable HTML tags with unique canary strings to confirm unescaped angle brackets in responses.
Escalation Paths: Progress from basic <b> tag injection to dangling-markup exfiltration and XSS when filters allow it.
Email-Context Testing: Detect injection into transactional emails where HTML renders unfiltered for recipients.
Use Case: While testing a search results page on an authorized target, inject <b>CANARY1234</b> into the query parameter and confirm the response contains literal angle brackets rather than < entities, proving the injection.

Quick Start

Ask the assistant to test the search field of your authorized target for HTML injection using a unique canary string.

Frequently Asked Questions about hunt-html-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for HTML injection in a web application?▼

Inject a recognizable HTML tag with a unique canary string, such as <b>CANARY1234</b>, into input fields like search boxes or comments. Confirm the vulnerability when the response contains literal angle brackets rather than HTML-encoded entities like <.

What is the difference between HTML injection and XSS?▼

HTML injection renders markup like <b> or <h1> without JavaScript execution, while XSS executes scripts such as <script>alert(1)</script>. Some WAFs block script tags but pass benign tags, so testers start with non-script payloads before escalating.

Can HTML injection work when script tags are blocked by a WAF?▼

Yes, WAFs often filter <script> but allow tags like <b>, <img>, or <a>. Dangling-markup injection with an unterminated <img src> tag can even exfiltrate page content like CSRF tokens without any script execution.

How do I prove HTML injection impact in a bug bounty report?▼

Use a distinctive 4+ digit canary in an active vector such as an injected form or image tag, and capture the raw unescaped payload in the response. Demonstrate phishing forms, redirects, or dangling-markup data leakage for stronger impact.

Where should I look for HTML injection vulnerabilities?▼

Target any input reflected or stored in HTML context: search parameters, comments, profile fields, error messages, contact forms, and admin-visible fields. Transactional emails are also high-value since they often render HTML unfiltered.