hunt-html-injection

## What is HTML Injection HTML Injection occurs when user input is inserted into a page's HTML without escaping, so injected tags are rendered by the browser as markup rather than displayed as literal text. Unlike XSS, the injected content does not require JavaScript execution — injecting `<b>`, `<h1>`, `<a>`, `<img>`, or `<form>` tags is sufficient. **To PROVE impact unambiguously, escalate to an active vector carrying a unique numeric canary** — e.g. `"><img src=x onerror=alert(91234)>` or `<svg onload=alert(91234)>`. A distinctive 4+ digit number (not `alert(1)`) distinguishes YOUR reflected injection from the example payloads practice pages embed in their own hint text. Proof = the raw, unescaped vector with your canary appears in the response. **Impact:** - Phishing via injected `<form>` or `<a href="attacker.com">` tags - UI defacement — `<h1>HACKED</h1>` renders visually on the page - Credential harvesting via injected login forms - Redirect via `<meta http-equiv="refresh">` - Stepping stone to XSS (may be blocked by WAF on `<script>` but not `<img onerror>`) ## Attack Surface Any input that is reflected or stored and then displayed in an HTML context: - Search boxes (`?q=`) - Comments, feedback, reviews - Profile fields (name, bio, username) - Error messages (`?error=`, `?message=`) - Subject / body of contact forms - Admin-visible fields (ticket titles, usernames in logs) ## Autonomous Testing Priority **Inject a recognisable HTML tag with a unique canary stri...