Hacking Tutorials: 2018

HTML Injection

What is HTML?

HTML is Hyper Text Markup Language which is used for for designing Web pages. HTML describes the structure of Web pages using markup. Its elements are the building blocks of HTML pages. HTML elements are the building block of HTML pages. Its element are represented by tags. HTML tags label pieces of content such as "heading", "title", "body", and so on.

Simple HTML program as shown below:

<HTML>

<HEAD>

<TITLE>My First HTML Page</TITLE>

</HEAD>

<BODY>

<H1>Heading of the Page</H1>

<P>Paragraph started</p>

</BODY>

</HTML>

HTML Injection

HTML injection is the vulnerability inside website or webpage which occurs when the user input is not correctly sanitized and the output is not encoded. Attacker can take advantage of this and can inject valid HTML code into a vulnerable web page. There are so many techniques which could be use element and attributes to submit HTML content. If website is vulnerable to HTML injection then there is a high risk of XSS, specifically an HTML injection one. If strings are not correctly sanitized the problem could lead to XSS based HTML injection. This vulnerability can have many consequences, like disclosure of a user’s session cookies that could be used to impersonate the victim, or, more generally, it can allow the attacker to modify the page content seen by the victims.

Two types of HTML injection

Stored HTML

Reflected HTML

The reflected HTML is also known as Non Persistence. It occurs when the web application respond immediately on user’s input without validating the inputs. This lead an attacker to injects browser executable code inside the single HTML response. It’s called “non-persistent” because the malicious script does not get stored inside the web Application database, therefore attacker will send the malicious link through phishing to trick the user.

Let’s started with the Reflected HTML injection. For this demonstration purpose I am using vulnerable Application.

Following web page allow user to submit his first and last name but these text field are vulnerable to HTML injection.

Figure 1

Now, by inserting HTML content in the First Name and Last Name field in the form we will check for the HTMl injection. Here I am entering the following HTML content as shown in the figure.

Figure 2

Here HTML content is

firstname<h1>Vulnerable to</h1>

lastname<h1>HTML injection</h1>

Now I click on the Go button. After Clicking go HTML content get executed and display immediately as shown below in the figure which, confirm us that application is vulnerable to HTML injection.

Figure 3

Now, stage is set and now we can do some evil and trick user to click on the link which will redirect user to the malicious website. As shown below in the figure.