I don't know much about content injection so I'm hoping to draw on the experience of the community here. I'm writing a tool that evaluates public web proxies. I want to know if the proxies are being used for content injection and other attacks. I.e. to determine if they are injecting malware, phishing attacks, or spam into the page being requested via the proxy. I need to determine which ones I can trust to use myself. I'm the only client.
To do this, I want to make a webpage that is the biggest target possible (AKA honeypot) in order to encourage the proxies to do their content injection if they do it at all. I'd like to know if there are there certain keywords, content, or ways to structure a web page that will encourage content injection. For example, I could have phrases like 'hot girls' in order to encourage porn and viagra advertisements. Or have frames and iframes in the body of the page in order to give the attackers a place to put the content.
At my end I will compare what was returned by the proxy with what I expect in order to determine if the proxy is changing the content at all.
I already check to see if certificates are changed. I mostly care about the fidelity of the page content.
What else should I do?