hunt-html-injection

仓库创建 2026年5月5日最近提交 1 天前SkillHot 收录 1 天前

▸ 精选理由

可发现可用于钓鱼或仿冒界面的注入点

▸ 风险提示

可被滥用于钓鱼或仿冒页面，需合法授权

这个 Skill 做什么

检测未转义的用户输入导致的 HTML 注入与界面风险

帮你找那种把用户输入原样插进页面的漏洞——输入会被当作 HTML 标签渲染（比如 <b>、<a>、<form>），能被用来钓鱼、篡改界面或偷收凭证。一般在搜索结果、个人资料、评论、错误信息等文本展示面做测试时用。和 XSS 比起来危害等级可能低点，但一旦能执行 JavaScript 就得升级到 XSS 检测。

▸ 展开 SKILL.md 英文原文

Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but not necessarily JavaScript). Lower severity than XSS but enables phishing, UI manipulation, and credential harvesting via injected forms. Use when testing text-display surfaces (search results, profile fields, comments, error messages, feedback forms). For markup that executes JavaScript, escalate to hunt-xss.

开发编程HTML 注入界面劫持漏洞检测通用

3.2k

Stars

493

Forks

仓库内 Skill

+332

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-html-injection/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-html-injection/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## What is HTML Injection

HTML Injection occurs when user input is inserted into a page's HTML without escaping, so injected tags are rendered by the browser as markup rather than displayed as literal text. Unlike XSS, the injected content does not require JavaScript execution — injecting `<b>`, `<h1>`, `<a>`, `<img>`, or `<form>` tags is sufficient.

**To PROVE impact unambiguously, escalate to an active vector carrying a unique numeric canary** — e.g. `"><img src=x onerror=alert(91234)>` or `<svg onload=alert(91234)>`. A distinctive 4+ digit number (not `alert(1)`) distinguishes YOUR reflected injection from the example payloads practice pages embed in their own hint text. Proof = the raw

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有