dangling-markup-injection

A web-security playbook for exfiltrating sensitive page data through HTML injection when JavaScript execution is blocked, for instance when a Content Security Policy forbids inline scripts and event handlers, a sanitizer strips script tags and handlers, or a WAF blocks known XSS patterns. The core insight is that stealing data does not require JavaScript; it only requires the browser to make a request whose URL contains the data. An unclosed tag attribute (a src, href, or action) 'consumes' subsequent page markup until a matching quote, sweeping content such as CSRF tokens and pre-filled form values into a request sent to an attacker-controlled server.

It enumerates the conditions under which the technique applies, then details exfiltration vectors: image tags (the most common), form-action hijacking, base-tag hijacking that reroutes relative URLs, meta-refresh redirects, link/stylesheet requests, legacy table backgrounds, and video/audio poster attributes, each annotated with the CSP directive that would block it. A table maps target data (CSRF tokens, pre-filled email, in-page API keys, session IDs, auto-filled passwords, OAuth state) to how it appears in the page and the corresponding steal technique. Browser-specific behavior is documented, including Chrome's blocking of dangling markup in img src values that contain '<' or newlines and the recommended fallback to form-action injection.

Use this when assessing an injection point that first appears unexploitable because scripts are blocked but sensitive data sits after the injection in the response. Advanced sections describe selective consumption by choosing the opposite quote type, a textarea-plus-form combination, comment and style dangling, and using an iframe name attribute together with window.name persistence across origins. The material is framed for authorized security testing and points to related skills for full XSS, CSP bypass, CSRF, CRLF injection, and web cache deception when dangling markup is combined into a larger chain.