Testing for HTML injection
HTML injection is the insertion of arbitrary HTML code into a vulnerable web page. Vulnerabilities in this area may lead to the disclosure of sensitive information or the modification of page content for the purposes of socially engineering the user.
Getting ready
We will use OWASP Mutillidae II’s Capture Data Page to determine whether the application is susceptible to HTML injection attacks.
How to do it...
- Navigate to OWASP 2013 | A1 - Injection (Other) | HTMLi Via Cookie Injection | Capture Data Page:
Figure 9.30 – Capture Data Page lesson
- Note how the page looks before the attack:
Figure 9.31 – Data Capture Page
Switch to the Burp Suite Proxy | Intercept tab and turn Intercept on with the Intercept is on button.
- While the request is paused, make a note of the last cookie,
acgroupswitchpersist=nada:
Figure...
