Angular: XSS without HTML tags
Retrieving parameters from the user and later displaying them on the website always carries risk of XSS attack. But can you perform such attack without using the html tag?
Subscribe: https://www.youtube.com/c/KacperSzure...
XSS happens when an unauthorized JavaScript code executes on our website.
Why is this attack dangerous? Using this code, we can steal the data of current user and perform some action on his behalf.
For example, post a post on a page or delete a photo.
When we google for XSS payloads, we can find many pages that provide a list of potential text strings used by pentesters.
It is a common practice to use the alert() function, which displays a popup with our message in the browser's window.
If with use of these payloads, we make it to display a popup, it means that we are vulnerable to this attack.
As we can see, these attacks are based on the use of HTML tags.
Tags are opened using the "less-than" sign and closed using the "greater-than" sign.
But if your site uses angular - the rules of protection against XSS attacks change.
Here, like in the case of server side template injection attacks, you can use special commands - enclosed between double brackets.
The easiest way to check if our site is vulnerable to this attack is to use math {{5-2}}
Twitter: / kacperszurek
Website: https://security.szurek.pl/
Github: https://github.com/kacperszurek/
#from0topentestinghero #security #angular
On this page of the site you can watch the video online Angular: XSS without HTML tags with a duration of hours minute second in good quality, which was uploaded by the user KacperSzurekEN 21 March 2019, share the link with friends and acquaintances, this video has already been watched 6,082 times on youtube and it was liked by 103 viewers. Enjoy your viewing!
