domains / families / security / dangling-markup-injection

dangling-markup-injection

separate

Dangling markup injection playbook. Use when HTML injection is possible but JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF blocks script tags) — exfiltrate CSRF tokens, session data, and page content by injecting unclosed HTML tags that capture subsequent page content.

When to use

• HTML injection with blocked JavaScript
• Exfiltrating CSRF tokens
• Exfiltrating session data
• Exfiltrating page content
• Bypassing CSP script restrictions
• Bypassing sanitizers stripping event handlers
• Bypassing WAFs blocking script tags

When not to use

• Full XSS scenarios
• CSP bypass when JS is not blocked

Skill page

Source