Access to raw html source code after angular client side processing

Question

I need help to check if parameters are sensitive to XSS injections in a webpage generated by angularjs.

Today, many websites are using angularjs in order to deport client page construction at the client side (so this work has not to be performed at server side anymore).

So, when I perform a HTTP request, the server answers with a source code which is a template for angular to construct the page. So, this server answer is not corresponding to the final webpage that I can see after angular processing.

by using CTRL+U (show source code), this is the same problem, I will only see the answer of the server (before angular processing).

By using firebug or web developer console, I can only see a kind of "render" of the raw source code.
For example, if a try to inject <script> in a parameter, after the angularjs processing, maybe <script> will be sanitized in <script>.
But, in the web developer console (or in firebug). I'll see <script> even if < and > are sanitized (because < and > are interpreted and humanly printed to me).

So, this is very difficult to check if my injection pattern is escaped or not (ok I don't see a popup, so i guess something is escaped). I'm looking for a way to easily get the raw source code of the page after that angularjs constructed the final page.

I have heard about phantomjs but I'm not sure if this cover exactly my needs and maybe there is a easier or quicker way

EDIT:
I know that angular has his own escaping rules. But I have succeeded to inject javascript code inside a parameter and execute it somewhere else (where it is displayed on another webpage). So I know that some parts of the website are not protected.

On a specific webpage, the parameter is displayed but the javascript is not executed, so I guess some special characters are escaped. And I want to know which ones.

Firefox and Chrome inspector give me the same view:

<span ...>aaaaaa<script>alert(1);</script>aaaaaa</span>

Finally, I have found that if I make a right click and "copy html" (chrome) or "edit" firefox. I can see the raw source code which show me what is actually escaped:

<span ...>aaaaaa&lt;script&gt;alert(1);&lt;/script&gt;aaaaaa</span>

For the little story, I have found this by wanting to copy the extract of code in a comment on security.stackexchange.com ^^

Answer 1

You can use Chrome's Inspector to view the DOM tree as HTML. There you see the rendered result of the AngularJS processing.

But provided that you use AngularJS correctly, it takes care of all escaping and won't allow any XSS vulnerabilities (otherwise they are vulnerabilities in AngularJS itself). You need to use $sce and ng-bind-html to make AngularJS insert random HTML unsanitized into the document.

Answer 2

As you said, characters such as < and > interpreted an humanly printed, you can know this if you double click the innerHTML of any element on the browser's dev tools, sometimes they are enclosed in double quotes, which means it is interpreted as text.

If you try to inject an alert(1); and it's not executed, it might mean that the string is properly parsed, or the browser blocked the XSS (Modern browsers won't execute JS code that is also found in the URL).

Another thing you can do if you can't see the webpage where the data is printed, is requesting an image (Just to give an example) from a web server you have access to, where the image URL would be server-side generated and at some point of the generation of the image, you store somewhere a confirmation that the code was executed, it may seem unclear, so I give an example:

https://example.com/hackyImage.jpg?someParam=hacked

Which you would put into the src of an image injected into some input

<img src="https://yourserver.com/hackyImage.jpg?someParam=hacked">

<input name="user" value="[INSERT PICTURE CODE HERE]">