{"slug":"elementalsouls-hunt-html-injection","name":"hunt-html-injection","description":"Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but not necessarily JavaScript). Lower severity than XSS but enables phishing, UI manipulation, and credential harvesting via injected forms. Use when testing text-display surfaces (search results, profile fields, comments, error messages, feedback forms). For markup that executes JavaScript, escalate to hunt-xss.","long_description":"---\nname: hunt-html-injection\ndescription: \"Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but not necessarily JavaScript). Lower severity than XSS but enables phishing, UI manipulation, and credential harvesting via injected forms. Use when testing text-display surfaces (search results, profile fields, comments, error messages, feedback forms). For markup that executes JavaScript, escalate to hunt-xss.\"\nsources: hackerone_public, public_research\nreport_count: 6\n---\n\n## What is HTML Injection\n\nHTML Injection occurs when user input is inserted into a page's HTML without escaping, so injected tags are rendered by the browser as markup rather than displayed as literal text. Unlike XSS, the injected content does not require JavaScript execution — injecting ``, `

`, ``, ``, or `
` tags is sufficient.\n\n**To PROVE impact unambiguously, escalate to an active vector carrying a unique numeric canary** — e.g. `\">` or ``. A distinctive 4+ digit number (not `alert(1)`) distinguishes YOUR reflected injection from the example payloads practice pages embed in their own hint text. Proof = the raw, unescaped vector with your canary appears in the response.\n\n**Impact:**\n- Phishing via injected `
` or `` tags\n- UI defacement — `

HACKED

` renders visually on the page\n- Credential harvesting via injected login forms\n- Redirect via ``\n- Stepping stone to XSS (may be blocked by WAF on `` — the same unsanitised input may allow full XSS.\n\n## Proof\n\nConfirmed when your injected tag appears in the response body with literal `<` angle brackets (not HTML-encoded). A safe app renders `<b>CANARY</b>`; a vulnerable app renders `CANARY`.\n\n## Distinguishing HTML Injection from XSS\n\n- HTML injection: `text` renders as **text** in the browser — no JS execution needed.\n- XSS: `` executes JavaScript.\n\nSome WAFs block `