I need help to check if parameters are sensitive to XSS injections in a webpage generated by angularjs.

Today, many websites are using angularjs in order to deport client page construction at the client side (so this work has not to be performed at server side anymore).

So, when I perform a HTTP request, the server answers with a source code which is a template for angular to construct the page. So, this server answer is not corresponding to the final webpage that I can see after angular processing.

by using CTRL+U (show source code), this is the same problem, I will only see the answer of the server (before angular processing).

By using firebug or web developer console, I can only see a kind of "render" of the raw source code.
For example, if a try to inject <script> in a parameter, after the angularjs processing, maybe <script> will be sanitized in &lt;script&gt;.
But, in the web developer console (or in firebug). I'll see <script> even if < and > are sanitized (because &lt; and &gt; are interpreted and humanly printed to me).

So, this is very difficult to check if my injection pattern is escaped or not (ok I don't see a popup, so i guess something is escaped). I'm looking for a way to easily get the raw source code of the page after that angularjs constructed the final page.

I have heard about phantomjs but I'm not sure if this cover exactly my needs and maybe there is a easier or quicker way

I know that angular has his own escaping rules. But I have succeeded to inject javascript code inside a parameter and execute it somewhere else (where it is displayed on another webpage). So I know that some parts of the website are not protected.

On a specific webpage, the parameter is displayed but the javascript is not executed, so I guess some special characters are escaped. And I want to know which ones.

Firefox and Chrome inspector give me the same view:

<span ...>aaaaaa<script>alert(1);</script>aaaaaa</span>

Finally, I have found that if I make a right click and "copy html" (chrome) or "edit" firefox. I can see the raw source code which show me what is actually escaped:

<span ...>aaaaaa&lt;script&gt;alert(1);&lt;/script&gt;aaaaaa</span>

For the little story, I have found this by wanting to copy the extract of code in a comment on security.stackexchange.com ^^

  • there is no such thing as dynamic raw source code, and how the DOM gets serialized has little/nothing to do with XSS vulnerabilities. so, while document.outerHTML contains the closest thing to what's described, there's no point in looking at it: If you don't see the alert, the script is safe... – dandavis Jul 5 '16 at 19:04

You can use Chrome's Inspector to view the DOM tree as HTML. There you see the rendered result of the AngularJS processing.

But provided that you use AngularJS correctly, it takes care of all escaping and won't allow any XSS vulnerabilities (otherwise they are vulnerabilities in AngularJS itself). You need to use $sce and ng-bind-html to make AngularJS insert random HTML unsanitized into the document.

| improve this answer | |
  • Thanks for your answer. In fact neither chrome or firefox inspectors or DOM views permit direct raw view of the source: in both cases a &lt; is showed as < (and I need to distinguish if this is a original '<' or a &lt; interpreted). I wanted to show you an extract of the code and this permit to me to see that copy function and these views permits to get the raw code. So thanks ;-) – Sibwara Jul 5 '16 at 15:31

As you said, characters such as < and > interpreted an humanly printed, you can know this if you double click the innerHTML of any element on the browser's dev tools, sometimes they are enclosed in double quotes, which means it is interpreted as text.

If you try to inject an alert(1); and it's not executed, it might mean that the string is properly parsed, or the browser blocked the XSS (Modern browsers won't execute JS code that is also found in the URL).

Another thing you can do if you can't see the webpage where the data is printed, is requesting an image (Just to give an example) from a web server you have access to, where the image URL would be server-side generated and at some point of the generation of the image, you store somewhere a confirmation that the code was executed, it may seem unclear, so I give an example:


Which you would put into the src of an image injected into some input

<img src="https://yourserver.com/hackyImage.jpg?someParam=hacked">

<input name="user" value="[INSERT PICTURE CODE HERE]">
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.