Collaborate Disseminate
Very simple question
– Is angular a secure option for enterprise development?
– Is it Angular 2/4 a valid alternative to .net MVC?
– Is there any special security process or recommendation for these environments?
I want to find the client MAC address using Angular JS or JavaScript. How can I do that?
Continue reading How to get client MAC address using Angular JS? [on hold]
I think I have this sorted, but would love to hear if I’m wrong. We have a Python+Angular.js set of apps, which are using JWT tokens for authentication, where the tokens are encrypted using a secret key, the payload identifie… Continue reading CSRF tokens for a JWT-auth system using cookies
Traditionall webapps are often pentested by vulnerability scanners like Burp Suite, OWASP ZAP or with the other gazillion tools included in Kali.
But what is the best way to pentest automatically a JavaScript web-app (Angula… Continue reading What is best way to pentest an AngularJS web app with a REST backend?
Traditionall webapps are often pentested by vuln. scanners like Burp-Suite, OWASP ZAP or with the other gazillion tools included in Kali.
But what is the best way to pentest automatically a JavaScript web-app (AngularJS) wit… Continue reading What is best way to pentest a JavaScript web-app (AngularJS) with a REST backend?
I do not see the point in using CSP 3’s new strict-dynamic in the case of an AngularJS 1.x application.
As far as I can tell, using strict-dynamic still allows arbitrary Javascript injection via a sandbox escape in a templat… Continue reading Is there any point in using ‘strict-dynamic’ in an AngularJS 1.x application?
I do not see the point in using CSP 3’s new strict-dynamic in the case of an AngularJS 1.x application.
As far as I can tell, using strict-dynamic still allows arbitrary Javascript injection via a sandbox escape in a templat… Continue reading Is there any point in using ‘strict-dynamic’ in an AngularJS 1.x application?
So the thing is I have created a Asp.Net web api and am using oauth to secure the access.
The problem is that the clients want to make a pure html(angular) website from which they will access the api. So basically they will c… Continue reading How to securely access web api from Html5 Website
Every experienced pentester knows there is a lot more to XSS than alert(1) – filtering, encoding, browser-quirks and WAFs all team up to keep things interesting. AngularJS Template Injection is no different. In this post, we will examine how we adapted… Continue reading Adapting AngularJS Payloads to Exploit Real World Applications
Every experienced pentester knows there is a lot more to XSS than <script>alert(1)</script> – filtering, encoding, browser-quirks and WAFs all team up to keep things interesting. AngularJS Template Injection is no different. In this post, we will examine how we adapted template injection payloads to bypass filtering and encoding and exploit Piwik and Uber.
Lower case conversion
Piwik, an Continue reading Adapting AngularJS Payloads to Exploit Real World Applications