try xss first, if xss payloads are being blocked then try html injection.

imp condition :- keyword must be reflected in the dom for html injection to work, it dosent matter if its getting reflecting in view page source.

same like reflected xss entry points, enter the html injection payload

<h1 style="color:red">HACKED</h1>

enter this payload in the entry points.

it is vulnerable only if the keyword “HACKED” is displayed in red with h1 tags.

<meta http-equiv="refresh" content="2; <https://evil.com/>" />

<a href="<https://malicious-site.com>">Click me!</a>