> For the complete documentation index, see [llms.txt](https://sec88.0x88.online/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sec88.0x88.online/web-appsec/features-abuse/messaging-features.md).

# Messaging Features

<details>

<summary><strong>Injection</strong></summary>

* [ ] Blind XSS/HTML Injection
* [ ] HTML injection in email rendering
* [ ] XSS HTML Injection in email section
* [ ] Inject in message body
* [ ] Inject in subject/title
* [ ] Inject in reply field
* [ ] Email header injection (`\n`, `%0a`)

```html
tester'\"/><<h1>h1>ester0x88<</h1>/h1>
0x88"><<img/src=https://tinyurl.com/ynaeed3d>img/src=https://tinyurl.com/ynaeed3d>
Your Account has been suspended you should change your password From Here <a/href=https://evil.com>change password</a
```

* [ ] Check execution in:
  * [ ] Web UI
  * [ ] Email notifications

</details>

<details>

<summary><strong>Markup Injection</strong></summary>

{% embed url="<https://medium.com/@iframe_h1/a-picture-that-steals-data-ff604ba1012>" %}

1. Go to <https://iplogger.org/>
2. Choose invisible
3. Image send the message

</details>

<details>

<summary><strong>IDOR</strong></summary>

* [ ] Change message ID in request → access other users’ messages
* [ ] Change conversation/thread ID → view other conversations
* [ ] Modify user/client ID in requests
* [ ] Send message as another user
* [ ] Modify recipient ID

</details>

<details>

<summary><strong>Improper Session Validation After Logout</strong></summary>

* [ ] Access messages after logout
* [ ] Reuse old session token after logout

</details>

<details>

<summary><strong>Privilege Escalation</strong></summary>

* [ ] Reply to a thread you shouldn’t have access to
* [ ] Access deleted/archived messages via direct endpoint
* [ ] Client accessing firm staff messages
* [ ] Staff accessing unauthorized threads

</details>

<details>

<summary><strong>Data Leakage in API Responses</strong></summary>

* [ ] Inspect API responses for hidden fields
* [ ] Leak email addresses or internal IDs
* [ ] Check for data leakage across accounts
* [ ] Trigger errors → check for stack traces
* [ ] Message metadata leakage

</details>

<details>

<summary><strong>Unauthenticated Access to APIs</strong></summary>

* [ ] Access APIs without authentication

</details>

<details>

<summary><strong>File Upload Issues</strong></summary>

* [ ] Upload `.html` files
* [ ] Upload `.svg` files
* [ ] Upload `.js` files
* [ ] Upload `PDF` with embedded `JS`
* [ ] Double extensions (`file.jpg.html`)
* [ ] Bypass `Content-Type` validation
* [ ] Inject payload in filename
* [ ] Access uploaded files via direct URL
* [ ] Modify sender ID
* [ ] Access other users’ attachments (IDOR)

</details>

<details>

<summary><strong>Leaked Sensitive Information in Email Notifications</strong></summary>

* [ ] Email contains full message content
* [ ] Email leaks sensitive data like emails
* [ ] Email exposes internal IDs or hidden fields
* [ ] Secure messaging leaks via email

</details>

<details>

<summary><strong>Rate Limit Issues</strong></summary>

* [ ] Check rate limiting
* [ ] Trigger multiple notifications (spam)
* [ ] Race Condition
* [ ] Send high volume of messages quickly
* [ ] Email bombing via notifications
* [ ] Very long messages (10k+ chars) -> `DoS Potential`

</details>

<details>

<summary><strong>BAC</strong></summary>

* [ ] Replay request (duplicate messages)
* [ ] Modify message content after sending
* [ ] Send message when messaging is disabled
* [ ] Send message when user is blocked
* [ ] Bypass client/staff messaging restrictions

</details>

<details>

<summary><strong>CSRF</strong></summary>

* [ ] Build CSRF PoC (auto-send message)

</details>

<details>

<summary><strong>Improper Input Validation</strong></summary>

* [ ] Unicode / RTL text
* [ ] Emojis
* [ ] Null byte injection (`%00`)
* [ ] Broken JSON / missing parameters

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://sec88.0x88.online/web-appsec/features-abuse/messaging-features.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.