Earlier in this course — in dom-xss (client-side) and reflected-and-persistent-xss (server-mediated) — you made your script run in the victim's browser. Script execution, though, is only the loudest result of a more general flaw: an application that writes untrusted input into a page as raw HTML. When that same unsafe write renders non-scripting markup - a link, a heading, an image, a framed page - you have HTML injection. When the point is simply to show a victim convincing attacker-controlled content, you have content spoofing.
These attacks matter precisely because they look harmless:
HTML injection is XSS without the script. It runs no JavaScript, trips no <script>-focused filter, and raises no obvious alarm - yet it lets an attacker place their own words, links, and images inside a page the victim trusts. That is the raw material of phishing.The difference from XSS is one row in a table:
- XSS injects active markup -
<script>,onerror=,javascript:- and the browser executes it. - HTML injection / content spoofing injects passive markup -
<a>,<h1>,<img>,<iframe>,<marquee>- and the browser renders it as page content.
And the punchline: a developer who "fixes XSS" by blocking <script> has done nothing about HTML injection. An injected <a href="https://evil.example">Verify your account</a> contains no script, sails through the filter, and renders as a real, clickable link inside the genuine, padlocked, correctly-styled page.
In this lesson you will:
- Use the same DOM sink as
dom-xss- the NovaCart search bar - to render a harmless tag and prove your markup is parsed. - Submit an HTML-injection payload that renders a link, heading, image, or frame without executing any script.
- See why blocking tag names is not a defense, and why contextual output encoding is the durable fix for HTML injection and XSS alike.
Estimated time: eight to twelve minutes.
Prerequisites: dom-xss and reflected-and-persistent-xss for XSS context, and browser-security-model for browser boundaries. input-validation-output-encoding formalizes the defensive pattern immediately after this lesson.
When you are ready, send the Continue signal.