BWAPP HTML Injection — Reflected (POST)

HTML injection is a type of injection vulnerability that occurs when a user is able to control an input point and is able to inject arbitrary HTML code into a vulnerable web page. This vulnerability can have many consequences, like disclosure of a user’s session cookies that could be used to impersonate the victim, or, more generally, it can allow the attacker to modify the page content seen by the victims. Reflected GET attack scenario in which the input is sent in the URL, not the body.

Reflected POST HTML Injection: is a little bit more difficult. It occurs when a malicious HTML code is being sent instead of correct POST method parameters.

Security level : low

This works almost same as reflected get html injection but the only difference is that the injected code is sent through body of the request (POST method).

In the above example we can see that the <script>alert(‘test’);</script> is encoded and send via body of the request.

Then the arbitrary code is processed and executed. Also we can see that there is no parameter shown in the URL because it uses POST method.