Collaborate Disseminate
I was going through a website and Retire.js found this bug for me:
https://imgur.com/q9RY3sQ
But I don’t know how to execute this bug $(sanitize) or whatever this is.
Please help me to create a valid PoC. Yes I know they ar… Continue reading How to Execute this XSS [on hold]
I’m creating WEB project in Angular4 and Spring. This is educational project for my learning.
I want to encrypt some data in Angular and then store it in backend. Idea is to not have any acces to user data in backend – user … Continue reading What are the best practices to secure an Angular & Spring web project?
I’m creating WEB project in Angular and Spring. This is educational project for my learning.
I want to encrypt some data in Angular and then store it in backend. Idea is to not have any acces to user data in backend – user w… Continue reading What are the best practices to secure an Angular & Spring web project?
I’m trying to develop a web app using ASP web API & Angular JS, each angular controllers need web services to get business data to visualize, please who can give a proper mechanism to secure internal web services in my ap… Continue reading How to secure my internal web service – ASP/MVC [on hold]
Context: Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (withCredentials = false by default)… Continue reading Do I need CSRF token if I’m using Bearer JWT?
Context: Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (withCredentials = false by default) and I use JWT… Continue reading Do I need CSRF token if I’m using Bearer JWT?
I am storing some data in html field for display purpose.
When I changed value of that field through inspect element, it get changed in server side also.
Due to project requirement, I am unable to use server side validation… Continue reading Identify content change in client browser on server side
So the other day at work I noticed this code in one of our web apps:
this.activatedRoute.params.subscribe(params => {
this.a = params[‘b’];
});
and then in the HTML:
{{a}}
So basically if I navigate to http://exa… Continue reading Is inserting url parameters directly into the page safe in angular 2+?
Having a tough time when trying to think about AngularJS XSS vulnerabilities. I’ve read a ton of articles on them, but I can’t seem to find a good example of vulnerable Angular code, only tons of Payload examples.
Basically,… Continue reading Angular <1.6 XSS Scoping
Last year in XSS Without HTML: Client-Side Template Injection with AngularJS we showed that naive use of the AngularJS framework exposes websites to Cross-Site Scripting (XSS) attacks, given a suitable sandbox escape. In this post, I’ll look at how to … Continue reading DOM based AngularJS sandbox escapes