This repository is a collection of in-depth articles documenting the bug hunting journey within our codebase. Each article is dedicated to a specific bug, issue, or vulnerability that has been identified and resolved during the development process. [ BTW: i just used chatgpt, gemini advance and own things to write this article full filly and make it easy to read .. ]
Hello, Our let's understanding HTML injection vulnerability.
At the outset we have not corrected all our confusions and misconceptions
What is HTML? HTML, or Hypertext Markup Language, serves as the foundation for building webpages. Through HTML, you can specify the placement of paragraphs, user input areas, and more on a webpage. Virtually all websites utilize HTML, making it susceptible to HTML injection.
What is HTML Injection? HTML Injection is a vulnerability similar to cross-site scripting. In the case of cross-site scripting, attackers inject JavaScript code and execute it if the target is vulnerable. With HTML injection, attackers can inject certain HTML tags, though not all.
Let's take a practical look at this vulnerability.
I'll be using a demo website for testing purposes: http://testphp.vulnweb.com/
Threat Model:
- Open Your Target Site -
-
Now, enter the specified payload in the search field.
<h1 style=”color:Blue;”>TCH Community</h1>
- Now, press the go button, and the 'TCH Community' will change its color to blue
- Success! The website Display HTML Injection, indicating vulnerability to this type of attack
-
The methodology of
Html-injectionis:- locating all user input fields and verify if the input provided is echoed/return back on the website
- Attempt injecting standard HTML tags, such as heading tags, and observe the website's response.
- In case the HTML code is executed, it indicates the presence of an HTML injection vulnerability. It's essential to continue the investigation beyond this point. So Don't Stop Here
- Attempt injecting JavaScript code. If the JavaScript code is successfully executed, you have identified an XSS vulnerability.
-
The most effective ways to prevent HTML Injection are:
Input Validation: Define strict rules for what data is allowed and reject anything that doesn't fit.Output Encoding: Convert HTML special characters (<, >, &, etc.) into their safe HTML entities (e.g., < for <) before displaying user-supplied data. This prevents the browser from interpreting them as executable code.- Content Security Policy (CSP): A powerful mechanism to help prevent HTML injection, XSS, and other attacks by controlling what code can execute on your site.
-
Also you can use this ways for find this vulnerability:
- Search Bars
- Contact Forms
- Comment Sections
- User Registration Forms
- Login Forms
- Feedback Forms
- Product Reviews
- Chat Boxes
- Newsletter Signup
- Profile Information, more
-
I hope the article is clear. Before concluding, I'd like to share some write-ups and HackerOne reports that can assist you in identifying HTML injection vulnerabilities.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wgpw-qqq2-gwv6 [ GitHub ]
- https://hackerone.com/reports/2210038 [ Hackerone ]
- https://hackerone.com/reports/358001 [ Hackerone ]
- https://medium.com/@pratiky054/html-injection-unique-exploitation-a5c3d4e6fed8 [ Medium ]
- https://www.softwaretestinghelp.com/html-injection-tutorial/ [ Software Testing ]
Medium Post - https://medium.com/@rhashibur75/html-injection-bug-bounty-a41f87217118
- Join Telegram Community - https://t.me/tch_community
- Follow on Linkedin - https://www.linkedin.com/in/ogh-bnz/
- Subscribe on YouTube - https://www.youtube.com/@RootMate?sub_confirmation=1
- If you have any qus ? - rhashibur75@gmail.com