> For the complete documentation index, see [llms.txt](https://heinosass.gitbook.io/leet-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heinosass.gitbook.io/leet-sheet/web-app-hacking/user-attacks/html-injection.md).

# HTML Injection

Occurs when you can inject HTML, but not Javascript for whatever reason.

### Steal Cookies

I haven’t tested this, but HTML5 allows for `<img>` tags with CORS cross-origin use-credentials. This would allow you to steal cookies if you have a website that accepts CORS-with-credentials requests and logs the cookies.

### Steal Credentials

You can try to [phish](/leet-sheet/web-app-hacking/user-attacks/phishing.md) for credentials.