Agent skill · security · davila7
HTML Injection Testing
This skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web applications", or "test content injection vulnerabilities". It provides comprehensive HTML injection attack techniques and testing methodologies.
Why this skill is useful
Provides specific techniques and methodologies for identifying and exploiting HTML injection vulnerabilities that the AI wouldn't reliably generate on its own.
What it needs
Requires burp suite, curl, owasp zap installed locally. About 6k tokens when loaded. Last updated 2026-08-06. 30,138 stars on the source repository.
What this skill does
HTML Injection Testing Purpose Identify and exploit HTML injection vulnerabilities that allow attackers to inject malicious HTML content into web applications. This vulnerability enables attackers to modify page appearance, create phishing pages, and steal user credentials through injected forms. Prerequisites Required Tools Web browser with developer tools Burp Suite or OWASP ZAP Tamper Data or similar proxy cURL for testing payloads Required Knowledge HTML fundamentals HTTP request/response structure Web application input handling Difference between HTML injection and XSS Outputs and Deliverables 1. Vulnerability Report - Identified injection points 2. Exploitation Proof - Demonstrated content manipulation 3. Impact Assessment - Potential phishing and defacement risks 4. Remediation Guidance - Input validation recommendations Core Workflow Phase 1: Understanding HTML Injection HTML injection occurs when user input is reflected in web pages without proper sanitization: Key differences from XSS: HTML injection: Only HTML tags are rendered XSS: JavaScript code is executed HTML injection is often stepping stone to XSS Attack goals: Modify website appearance (defacement) Create fake login forms (phishing) Inject malicious links Display misleading content Phase 2: Identifying Injection Points Map application for potential injection surfaces: Common vulnerable parameters: Phase 3: Basic HTML Injection Testing Test with simple HTML tags: Testing workflow: Phase 4: Types of HTML Injection Stored HTML Injection Payload persists in database: Reflected GET Injection Payload in URL parameters: Reflected POST Injection Payload in POST data: URL-Based Injection Inject into displayed URLs: Phase 5: Phishing Attack Construction Create convincing phishing forms: URL-encoded phishing link: Phase 6: Defacement Payloads Website appearance manipulation: Phase 7: Advanced Injection Techniques CSS Injection Meta Tag Injection Form Action Override iframe Injection Phase 8: Bypass Techniqu …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills davila7/html-injection-testing