I am trying to Pentest an application which is built in AngularJS. The difficulties that I am facing:
- Burp Suite's "spider this host" option is not able to crawl all the urls as most of the requests are AJAX and Angular based.
- When I am trying manually to parse all the links using Burp Suite. It is able to parse only home page link. Rest clicks are not intercepted.
- I am not able to get the contents of the templates used for various layouts. Like: "
App/src/dashboard/Menu/Menu.box.tpl.html" is one of the template used in Angular Directive. But how to parse its html contents. (Just like we get html source for general parsed urls).
Here, Acunetix was bit helpful to give the brief idea how the application is parsing the contents. But for manual pentest I am not getting proper solution like which tools, methods etc I should use.
Please guide me if anyone knows about Angular App pentesting methodologies.
Is there any link/resource/tutorials out there for AngularJS app pentest?