Agent skill · security · aiskillstore
html-injection-testing
Identify and exploit HTML injection vulnerabilities that allow attackers to inject malicious HTML content into web applications. This vulnerability enables attackers to modify page appearance, create phishing pages, and steal user credentials through injected forms.
Why this skill is useful
Provides specific testing workflows and commands for identifying and exploiting HTML injection vulnerabilities that the AI wouldn't reliably generate on its own.
What it needs
Requires burp suite, curl, owasp zap installed locally. About 6k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments. HTML Injection Testing Purpose Identify and exploit HTML injection vulnerabilities that allow attackers to inject malicious HTML content into web applications. This vulnerability enables attackers to modify page appearance, create phishing pages, and steal user credentials through injected forms. Prerequisites Required Tools Web browser with developer tools Burp Suite or OWASP ZAP Tamper Data or similar proxy cURL for testing payloads Required Knowledge HTML fundamentals HTTP request/response structure Web application input handling Difference between HTML injection and XSS Outputs and Deliverables 1. Vulnerability Report - Identified injection points 2. Exploitation Proof - Demonstrated content manipulation 3. Impact Assessment - Potential phishing and defacement risks 4. Remediation Guidance - Input validation recommendations Core Workflow Phase 1: Understanding HTML Injection HTML injection occurs when user input is reflected in web pages without proper sanitization: Key differences from XSS: HTML injection: Only HTML tags are rendered XSS: JavaScript code is executed HTML injection is often stepping stone to XSS Attack goals: Modify website appearance (defacement) Create fake login forms (phishing) Inject malicious links Display misleading content Phase 2: Identifying Injection Points Map application for potential injection surfaces: Common vulnerable parameters: Phase 3: Basic HTML Injection Testing Test with simple HTML tags: Testing workflow: Phase 4: Types of HTML Injection Stored HTML Injection Payload persists in database: Reflected GET Injection Payload in URL parameters: Reflected POST Injection Payload in POST data: URL-Based Injection Inject into displayed URLs: Phase 5: Phishing Attack Construction Create convincing phishing forms: URL-encoded phishing link: Phase 6: Defacement Payloads Website appearance manipula …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/html-injection-testing