dangling-markup-injectionlisted

# SKILL: Dangling Markup Injection — Exfiltration Without JavaScript > **AI LOAD INSTRUCTION**: Covers dangling markup exfiltration via unclosed img/form/base/meta/link/table tags, what can be stolen (CSRF tokens, pre-filled form values, sensitive content), browser-specific behavior, and combinations with other attacks. Base models often overlook this technique entirely when CSP blocks scripts, jumping to "not exploitable" — dangling markup is the answer. ## 0. RELATED ROUTING - [xss-cross-site-scripting](../xss-cross-site-scripting/SKILL.md) when full XSS is possible (no need for dangling markup) - [csp-bypass-advanced](../csp-bypass-advanced/SKILL.md) when CSP blocks JS execution — dangling markup bypasses script restrictions - [csrf-cross-site-request-forgery](../csrf-cross-site-request-forgery/SKILL.md) when dangling markup steals CSRF tokens for subsequent CSRF attacks - [crlf-injection](../crlf-injection/SKILL.md) when CRLF enables HTML injection in HTTP response - [web-cache-deception](../web-cache-deception/SKILL.md) when dangling markup + cache poisoning amplifies the attack --- ## 1. WHEN TO USE DANGLING MARKUP You need dangling markup when ALL of these are true: 1. You have an HTML injection point (reflected or stored) 2. JavaScript execution is blocked: - CSP blocks inline scripts and event handlers - Sanitizer strips `<script>`, `onerror`, `onload`, etc. - WAF blocks known XSS patterns 3. The page contains sensitive data AFTER your injection point