dangling-markup-injection

SKILL: Dangling Markup Injection — Exfiltration Without JavaScript

AI LOAD INSTRUCTION: Covers dangling markup exfiltration via unclosed img/form/base/meta/link/table tags, what can be stolen (CSRF tokens, pre-filled form values, sensitive content), browser-specific behavior, and combinations with other attacks. Base models often overlook this technique entirely when CSP blocks scripts, jumping to "not exploitable" — dangling markup is the answer.

0. RELATED ROUTING

• xss-cross-site-scripting when full XSS is possible (no need for dangling markup)
• csp-bypass-advanced when CSP blocks JS execution — dangling markup bypasses script restrictions
• csrf-cross-site-request-forgery when dangling markup steals CSRF tokens for subsequent CSRF attacks
• crlf-injection when CRLF enables HTML injection in HTTP response
• web-cache-deception when dangling markup + cache poisoning amplifies the attack

---

1. WHEN TO USE DANGLING MARKUP

You need dangling markup when ALL of these are true:

1. You have an HTML injection point (reflected or stored)
2. JavaScript execution is blocked:
   • CSP blocks inline scripts and event handlers
   • Sanitizer strips <script>, onerror, onload, etc.
   • WAF blocks known XSS patterns
3. The page contains sensitive data AFTER your injection point:
   • CSRF tokens
   • Pre-filled form values (email, username, API keys)
   • Session identifiers in hidden fields
   • Sensitive user content

Core insight: You don't need JavaScript to exfiltrate data — you just need the browser to make a request that includes the data in the URL.

---

2. CORE TECHNIQUE

Inject an unclosed HTML tag with a src, href, action, or similar attribute pointing to your server. The unclosed attribute quote "consumes" all subsequent page content until the browser finds a matching quote.