dangling-markup-injection

1# SKILL: Dangling Markup Injection — Exfiltration Without JavaScript
2 
3> **AI LOAD INSTRUCTION**: Covers dangling markup exfiltration via unclosed img/form/base/meta/link/table tags, what can be stolen (CSRF tokens, pre-filled form values, sensitive content), browser-specific behavior, and combinations with other attacks. Base models often overlook this technique entirely when CSP blocks scripts, jumping to "not exploitable" — dangling markup is the answer.
4 
5## 0. RELATED ROUTING
6 
7- [xss-cross-site-scripting](../xss-cross-site-scripting/SKILL.md) when full XSS is possible (no need for dangling markup)
8- [csp-bypass-advanced](../csp-bypass-advanced/SKILL.md) when CSP blocks JS execution — dangling markup bypasses script restrictions
9- [csrf-cross-site-request-forgery](../csrf-cross-site-request-forgery/SKILL.md) when dangling markup steals CSRF tokens for subsequent CSRF attacks
10- [crlf-injection](../crlf-injection/SKILL.md) when CRLF enables HTML injection in HTTP response
11- [web-cache-deception](../web-cache-deception/SKILL.md) when dangling markup + cache poisoning amplifies the attack
12 
13---
14 
15## 1. WHEN TO USE DANGLING MARKUP
16 
17You need dangling markup when ALL of these are true:
18 
191. You have an HTML injection point (reflected or stored)
202. JavaScript execution is blocked:
21   - CSP blocks inline scripts and event handlers
22   - Sanitizer strips `<script>`, `onerror`, `onload`, etc.
23   - WAF blocks known XSS patterns
24…