OWASP's HTML injection

Summary

HTML injection is a type of injection issue this occurs when a user are able to control an input point and are able to injec T arbitrary (any) HTML code into a vulnerable web page. This vulnerability can has many consequences (consequences), like disclosure of a user's session cookies that could is used to Imper Sonate (imitation) The victim, or, more generally, it can allow the attacker to modify the page content seen by the victims.

This vulnerability occurs when the user input was not correctly sanitized (disinfection) and the output is not encoded. An injection allows the attacker to send a malicious (malicious) HTML page to a victim. The targeted browser is not being able to distinguish (trust) the legit (legal) from the malicious parts and consequently would Parse and execute all as legit in the victim context.

How to Test

There is a wide range of methods and attributes that could being used to render HTML content. If These methods is provided with a untrusted input, then there is a high risk of XSS, specifically an HTML injection o NE. Malicious HTML code could was injected for example via (via) InnerHTML, which is the used to render user inserted HTML code. If strings is not correctly sanitized the problem could leads to XSS based HTML injection. Another method could be document.write ().

Test in Bwapp

　　

Enter HTML code:

Input script: <script>alert (document.cookie) </script>

NC Pinball headers:

The NC went, more use later update ....

OWASP's HTML injection