1. Navigate to OWASP 2013 | A1 – Injection (Other) | HTMLi Via Cookie Injection | Capture Data Page:

2. Note how the page looks before the attack:

3. Switch to the Burp Proxy Intercept tab, and turn Interceptor on with the button Intercept is on.
4. While the request is paused, make note of the last cookie, acgroupswitchpersist=nada:

5. While the request is paused, replace the value of the last cookie, with this HTML injection script:

<h1>Sorry, please login again</h1><br/>Username<input type="text"><br/>Password<input type="text"><br/><input type="submit" value="Submit"><h1>&nbsp;</h1>

6. Click the Forward button. Now turn Interceptor off by clicking the toggle button to Intercept is off.
7. Note how the HTML is now included inside the page!