Introduction To Reflected XSS with AngularJS sandbox escape without strings

Reflected Cross-Site Scripting (XSS) with AngularJS sandbox escape without using strings is a web security vulnerability where untrusted user input is not properly sanitized or validated. An attacker can exploit vulnerabilities in the AngularJS framework to bypass the sandbox and execute arbitrary scripts. To mitigate this vulnerability, web developers should follow secure coding practices, conduct thorough input validation and output encoding, and prioritize web security. Regular security assessments and updates can help protect web applications, safeguard user data, and maintain a secure online environment.

Lab Solutions | Practical Work Time XSS with AngularJS sandbox

This lab uses AngularJS in an unusual way where the $eval function is not available and you will be unable to use any strings in AngularJS.

To solve the lab, perform a cross-site scripting attack that escapes the sandbox and executes the alert function without using the $eval function.

Stepwise Solution of the lab:-

After accessing this lab, we first noticed it has “Search” functionality and you can see there are lots of posts. (Scroll down a little bit)

But here we have nothing to do with those things. We will directly jump on URL. And inject this below payload.

?search=1&toString().constructor.prototype.charAt%3d[].join;[1]|orderBy:toString().constructor.fromCharCode(120,61,97,108,101,114,116,40,49,41)=1

Now press enter and let’s see what will happen.

BOOM! We’ve successfully solved this lab.

Be ready for its other parts 🙂

I hope you had loved reading this article after you had completed this article we highly recommend you to study the next article: Reflected XSS with AngularJS sandbox escape and CSP, please don’t forget to leave a comment over here and share it with your friends as well, Good Luck!

Thank you for reading, if this article really helps you then do share it with your mates.
And follow @masaudsec on Twitter.