Support HackTricks and get benefits!

Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**

# Resume This technique can be use to extract information from a user when an **HTML injection is found**. This is very useful if you **don't find any way to exploit a** [**XSS** ](xss-cross-site-scripting/)but you can **inject some HTML tags**.\ It is also useful if some **secret is saved in clear text** in the HTML and you want to **exfiltrate** it from the client, or if you want to mislead some script execution. Several techniques commented here can be used to bypass some [**Content Security Policy**](content-security-policy-csp-bypass/) by exfiltrating information in unexpected ways (html tags, CSS, http-meta tags, forms, base...). # Main Applications ## Stealing clear text secrets If you inject `test ``` ## Stealing forms ```markup ``` Then, the forms that send data to path (like `

`) will send the data to the malicious domain. ## Stealing forms 2 Set a form header: `` this will overwrite the next form header and all the data from the form will be sent to the attacker. ## Stealing forms 3 The button can change the URL where the information of the form is going to be sent with the attribute "formaction": ```markup I get consumed! ``` An attacker can use this to steal the information. ## Stealing clear text secrets 2 Using the latest mentioned technique to steal forms (injecting a new form header) you can then inject a new input field: ```markup ` tag. All the data until a closed `` is found will be sent: ```markup Click Me ← Injected lines ← Existing form (ignored by the parser) ... ← Subverted field ... ... ``` ## Stealing clear text secrets via noscript `` Is a tag whose content will be interpreted if the browser doesn't support javascript (you can enable/disable Javascript in Chrome in [chrome://settings/content/javascript](chrome://settings/content/javascript)). A way to exfiltrate the content of the web page from the point of injection to the bottom to an attacker controlled site will be injecting this: ```markup