HTML Injection

What is HTML Injection?

HTML injection represents a specific type of injection vulnerability that arises when a user gains the ability to manipulate an input point within a web application. Exploiting this vulnerability allows the user to insert arbitrary HTML code into a web page that lacks adequate defenses, potentially leading to unauthorized content insertion, visual manipulation, and even security breaches. It is similar to xss.

There are two types of Html Injection

  1. Reflected HTML Injection: Reflected HTML injection involves tricking users into              interacting with specially crafted links or forms that inject malicious HTML code,                leading to its execution in the victim's browser. It is usually done in search engines, chat        boxes.

1.     2. Stored HTML Injection: Stored HTML injection occurs when an attacker injects                malicious HTML code into a web application's database or storage, which is then                displayed to other users, leading to code execution in their browsers. It is usually done          in user account.

How HTML Injection occurs?

HTML injection takes place when a malicious actor capitalizes on vulnerability within a web application to insert unauthorized HTML code into the content generated by the application. Once injected, this unauthorized HTML code is subsequently interpreted and displayed by the victim's web browser when they visit the compromised webpage.

Here's how the process typically works:

1. User Input Point: Web Applications usually takes input from the user in forms fields, search queries. These provided inputs are utilized to generate dynamic content, which is then displayed on web pages.

     2. Malicious Input and Injection: When an attacker identifies a weak input point where the data provided by user is not properly sanitized, escaped or checked he/she will try to inject malicious HTML code. It can be HTML tags, attributes, and content that the attacker wants to inject into the web page. Here, the tag used is “<font color = green>Hello, This is for educational purpose only</font>”.

3. Lack of Validation: If the web page does not validate user input properly then the injected code remains intact in the output.

1.   4. Rendering: When a victim accesses the compromised web page, their browser interprets the injected HTML code as part of the page's content.

    5. Consequences: Attacker might alter the appearance of the page, distributing malware, or performing other malicious actions

    Here, the example given is for Reflected HTML. Steps for Stored HTML are same as Reflected HTML.

  Impact Of HTML Injection

   Defacement: HTML Code can be injected by the attacker to modify the appearance of the website potentially resulting in a defaced or modified site. This could have adverse consequences for the website's credibility and reputation.

Injecting audio through HTML injection can disrupt user experience, annoy visitors, and negatively impact brand reputation. It may lead to confusion, accessibility problems, and potential privacy concerns, while also posing risks of browser compatibility issues and diverting resources for mitigation.

      HTML-injected videos can also disrupt page layout, leading to distorted content presentation. They might slow down page loading, causing a poor user experience and potentially harming the website's credibility. Moreover, videos could inadvertently expose sensitive information or facilitate phishing attacks, impacting user trust and security.

Commonly used payloads by attackers are as follows:

1. "<font color =  red>This is for Educational purpose only</font>" This payload is used          for  injecting and changing the font color of a text.

2. "<marquee>This is for Educational purpose only</marquee>" This HTML Element is          used to create scrolling text or images.

3. "<i>Hello</i>" This tag will convert the tag in italic. Similarly, it can also be used for            Bold  "<b>" and underline "<u>".

4. For injecting images attackers use "<img src="flower.jpg" alt="sunflower">".

5. "<video src="Flower.mp4" controls></video>" This payload is used for injecting video in      a website.

6. "<audio controls><source src="audio.mp3" type="audio/mp3"></audio>This payload is        used for injecting audio in a website.

    Some of the Preventive measures that web developers can undertake:

• Validate and Sanitize Inputs: Before processing the input provided by the user properly   validate and sanitize the data.
• Output Encoding: Output Encoding involves correctly encoding the content that is being generated, ensuring that browsers do not interpret it as executable code. Employ functions or libraries explicitly designed for encoding HTML output.
• Blocking Special Symbols: Implement measures to block all symbols that might potentially lead to code execution, thereby minimizing the risk of malicious manipulation.