8

I am trying to Pentest an application which is built in AngularJS. The difficulties that I am facing:

  1. Burp Suite's "spider this host" option is not able to crawl all the urls as most of the requests are AJAX and Angular based.
  2. When I am trying manually to parse all the links using Burp Suite. It is able to parse only home page link. Rest clicks are not intercepted.
  3. I am not able to get the contents of the templates used for various layouts. Like: "App/src/dashboard/Menu/Menu.box.tpl.html" is one of the template used in Angular Directive. But how to parse its html contents. (Just like we get html source for general parsed urls).

Here, Acunetix was bit helpful to give the brief idea how the application is parsing the contents. But for manual pentest I am not getting proper solution like which tools, methods etc I should use.

Please guide me if anyone knows about Angular App pentesting methodologies.

Is there any link/resource/tutorials out there for AngularJS app pentest?

  • Just generalities (so a comment and not an anwser...) but client side applications can be vulnerable to man in the middle: try to spy the exchanges with wireshark (if not encrypted) or with browser internal debugger to see whether it is possible to workaround any security through IHM with direct forged requests. – Serge Ballesta Aug 8 '16 at 10:22
4

Used to teach app pentest classes for a Fortune 20 appsec vendor to Fortune 100 clients. Years ago the state-of-the art for these types of assessments was the OWASP Ajax Crawling Tool where one had to manually input all of the Ajax parameters and actions.

For AngularJS, there is the AngularJS Batarang Chrome Extension in the Chrome Extension Store -- very useful for debugging. If you also happen to run into Node.js (likely), then you can also leverage the iron-node debugging tool. If you do any Javascript prototyping or development, I also suggest checking out the ternjs (Intellisense-like) add-on to the Atom Editor. nVisium Security wrote up a blog post on some of the security issues in AngularJS. Dinis Cruz also writes on AngularJS regularly.

Single-Page Applications can be worked much more efficiently using BurpKit, and to get an efficient crawl, check out htcap.

  • I tried batarang also. It helped in understanding the layout and template structure. But I was not able to edit/modify to test the scenarios as we do in developer's tool. Moreover, blog links and Burpkit, htcap info are awesome. Many thanks @atdre – Jassi Mar 13 '16 at 12:31
  • 1
    I found good video about burpkit: youtube.com/watch?v=csMN9sEiDUI it's very fantastic video. I hope it will be useful. – za_al Aug 8 '16 at 9:13
  • 1
    Just wanted to provide some input on the nVisium Security article you posted. That's really a horrible example of "bad security" on the AngularJS side of things, as it boiled down to "restricted data is stored on the client-side and accessed via a permission flag that is ALSO set on the client-side". It wasn't a security limitation of AngularJS in particular, but a security limitation of any client-facing code. – Patrick Bell Aug 8 '16 at 14:45

protected by Community Dec 14 '17 at 10:00

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.