Chapter 2 - HTML

Abstract

This chapter discusses HTML (HyperText Markup Language), the markup language for structuring Web pages. Mastering HTML from a security point of view—in terms of both attack and defense—is complicated and requires almost encyclopedic knowledge. This chapter attempts to provide hat knowledge. In addition to discussing the HTML family and its hidden gems for attackers and trapdoors for defenders, this chapter sheds some light on the differences between the different HTML standards and their actual implementations. The history and basic elements of HTML and markup languages are discussed to get a better understanding of how and where to obfuscate. Some ways to obfuscate markup include execution of JavaScript, the obfuscation of a URL, or even a DoS attack against the client rendering the markup. Markup and HTML are difficult to parse and secure, and the user agents make this task difficult by allowing crazy combinations of characters, attributes, and tags to execute JavaScript. HTML is usually part of an attack against Web applications; although it is called a “markup language,” it is very powerful and should be treated with respect.