Angular: XSS without HTML tags
Retrieving parameters from the user and later displaying them on the website always carries risk of XSS attack. But can you perform such attack without using the html tag?
Subscribe: https://www.youtube.com/c/KacperSzure...
XSS happens when an unauthorized JavaScript code executes on our website.
Why is this attack dangerous? Using this code, we can steal the data of current user and perform some action on his behalf.
For example, post a post on a page or delete a photo.
When we google for XSS payloads, we can find many pages that provide a list of potential text strings used by pentesters.
It is a common practice to use the alert() function, which displays a popup with our message in the browser's window.
If with use of these payloads, we make it to display a popup, it means that we are vulnerable to this attack.
As we can see, these attacks are based on the use of HTML tags.
Tags are opened using the "less-than" sign and closed using the "greater-than" sign.
But if your site uses angular - the rules of protection against XSS attacks change.
Here, like in the case of server side template injection attacks, you can use special commands - enclosed between double brackets.
The easiest way to check if our site is vulnerable to this attack is to use math {{5-2}}
Twitter: / kacperszurek
Website: https://security.szurek.pl/
Github: https://github.com/kacperszurek/
#from0topentestinghero #security #angular
Sur cette page du site, vous pouvez voir la vidéo en ligne Angular: XSS without HTML tags durée heure minute seconde en bonne qualité , qui a été Téléchargé par l'utilisateur KacperSzurekEN 21 mars 2019, Partagez le lien avec vos amis et connaissances, sur youtube cette vidéo a déjà été regardée 6,082 fois et il a aimé 103 téléspectateurs. Bon visionnage!
