Тестирование HTML-injection в веб-приложениях

★ 6.6 · security

html-injection-testing is a Claude Code skill that provides a structured methodology for finding and exploiting HTML injection vulnerabilities in web applications, covering stored, reflected GET/POST, and URL-based injection types. The workflow spans four phases: understanding how unsanitized input renders as HTML, mapping attack surfaces such as search bars, comment sections, profile fields, and URL parameters, running curl and Burp Suite / OWASP ZAP tests with basic tag payloads, and constructing advanced phishing overlays and defacement proofs-of-concept. Ready-to-use curl commands, URL-encoded payloads, and fake login form templates are included. Deliverables include a vulnerability report with identified injection points, exploitation proof, impact assessment covering phishing and defacement risks, and input validation remediation guidance. Designed for penetration testers and security engineers auditing web applications for content injection weaknesses.