Individual skill

exploiting-dangling-markup-injection

Exploiting dangling markup / scriptless HTML injection to exfiltrate clear-text secrets, steal form data, subvert application flow, and bypass CSP when full XSS is not possible. Covers unterminated img/meta/table/link/base tags, CSS @import, form/input/textarea/option hijacking, base-tag + window.name CSP evasion, and dangling-iframe leaks. Activates when HTML injection is found but JavaScript execution is blocked or filtered.

internal/tools/skills/data/web-application-security/exploiting-dangling-markup-injection/SKILL.md

Read pinned source

Source commit d42f381ad34843e71a42658e5c57290c713e85af

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 7, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 1,313
Repository last updated: Nov 7, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

cybersecurity Repository topic
security Repository topic
bug-bounty Repository topic
automation Repository topic
autonomous-pentesting Repository topic
ai-agent Repository topic
ai-security Repository topic
ethical-hacking Repository topic
golang Repository topic
penetration-testing Repository topic
penetration-testing Declared skill tag
dangling-markup Declared skill tag
html-injection Declared skill tag
owasp Declared skill tag
web-security Declared skill tag
data Derived category
security Derived category
testing Derived category
security-application Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 10,687 bytes

Read excerpt


# Exploiting Dangling Markup Injection

## When to Use

- During authorized assessments where you can inject HTML tags but cannot execute JavaScript (XSS blocked/filtered)
- When a CSP prevents script execution but still allows markup, CSS, meta tags, forms, or base tags
- When a secret (token, PII, CSRF value) is rendered in clear text in the HTML near your injection point
- When you can inject into a page that contains a form whose action/fields you want to subvert
- When you want to mislead client-side script flow by overriding element IDs/names or JS globals

## Prerequisites

- **Authorization**: Engagement scope covering client-side injection and data exfiltration
- **An HTML injection point**: A reflected/stored sink that renders raw tags (even if JS is filtered)