. HTML injection is lower severity but enables phishing, UI defacement, and can escalate to XSS."}},{"@type":"Question","name":"Can HTML injection work when script tags are blocked by a WAF?","acceptedAnswer":{"@type":"Answer","text":"Yes, many WAFs block

Verified:Website GitHub

hunt-html-injection

Detect HTML injection vulnerabilities by injecting canary-tagged markup into reflected input fields.

Updated Sep 6, 2026

Search Tags:#xss #security testing #penetration testing #bug bounty #sanitisation #html injection #web vulnerability

One-click install

npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-html-injection-inventashif

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: hunt-html-injection
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-html-injection
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-html-injection-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications that render user input as raw HTML without sanitisation allow attackers to inject arbitrary tags, enabling phishing, UI defacement, and credential harvesting. This Skill provides a systematic methodology to identify and prove HTML injection vulnerabilities during security testing. ## Core Features & Use Cases - Canary-Based Detection: Inject recognisable HTML tags with unique canary strings to confirm unescaped angle brackets in responses. - Escalation Guidance: Progress from basic tag injection (`<b>`, `<h1>`) to active vectors like `<img onerror>` and dangling-markup exfiltration when filters block scripts. - Use Case: While testing a search results page, inject `"><b>CANARY123</b>` into the query parameter and inspect the response — if the literal tag appears unescaped, you have confirmed HTML injection and can escalate toward XSS or document a phishing vector via injected forms. ## Quick Start Test the search parameter of the target application for HTML injection using a unique canary tag and report whether the response renders it unescaped.

Frequently Asked Questions about hunt-html-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test a website for HTML injection?▼

Inject a recognisable HTML tag with a unique canary string, such as <b>CANARY</b>, into reflected input fields like search boxes or profile fields. If the response contains the literal tag with unescaped angle brackets rather than < entities, the injection is confirmed.

What is the difference between HTML injection and XSS?▼

HTML injection renders injected tags like <b> or <h1> as markup without requiring JavaScript execution, while XSS executes scripts such as <script>alert(1)</script>. HTML injection is lower severity but enables phishing, UI defacement, and can escalate to XSS.

Can HTML injection work when script tags are blocked by a WAF?▼

Yes, many WAFs block <script> but pass tags like <b>, <img>, or <a>. Dangling-markup injection with an unterminated <img src> tag can even exfiltrate page content like CSRF tokens when full XSS is blocked.

What input fields should I test for HTML injection?▼

Test any input reflected or stored and displayed in HTML context: search boxes, comments, feedback forms, profile fields like name and bio, error messages, contact form subjects, and admin-visible fields such as ticket titles.

Why use a unique canary number instead of alert(1) in payloads?▼

A distinctive 4+ digit number like alert(91234) distinguishes your reflected injection from example payloads that practice pages embed in their own hint text. This proves your specific vector executed rather than matching pre-existing page content.