hunt-html-injection

1## What is HTML Injection
2 
3HTML Injection occurs when user input is inserted into a page's HTML without escaping, so injected tags are rendered by the browser as markup rather than displayed as literal text. Unlike XSS, the injected content does not require JavaScript execution — injecting `<b>`, `<h1>`, `<a>`, `<img>`, or `<form>` tags is sufficient.
4 
5**To PROVE impact unambiguously, escalate to an active vector carrying a unique numeric canary** — e.g. `"><img src=x onerror=alert(91234)>` or `<svg onload=alert(91234)>`. A distinctive 4+ digit number (not `alert(1)`) distinguishes YOUR reflected injection from the example payloads practice pages embed in their own hint text. Proof = the raw, unescaped vector with your canary appears in the response.
6 
7**Impact:**
8- Phishing via injected `<form>` or `<a href="attacker.com">` tags
9- UI defacement — `<h1>HACKED</h1>` renders visually on the page
10- Credential harvesting via injected login forms
11- Redirect via `<meta http-equiv="refresh">`
12- Stepping stone to XSS (may be blocked by WAF on `<script>` but not `<img onerror>`)
13…