I need help to check if parameters are sensitive to XSS injections in a webpage generated by angularjs.
Today, many websites are using angularjs in order to deport client page construction at the client side (so this work has not to be performed at server side anymore).
So, when I perform a HTTP request, the server answers with a source code which is a template for angular to construct the page. So, this server answer is not corresponding to the final webpage that I can see after angular processing.
by using CTRL+U (show source code), this is the same problem, I will only see the answer of the server (before angular processing).
By using firebug or web developer console, I can only see a kind of "render" of the raw source code.
For example, if a try to inject
<script> in a parameter, after the angularjs processing, maybe
<script> will be sanitized in
But, in the web developer console (or in firebug). I'll see
<script> even if
> are sanitized (because
> are interpreted and humanly printed to me).
So, this is very difficult to check if my injection pattern is escaped or not (ok I don't see a popup, so i guess something is escaped). I'm looking for a way to easily get the raw source code of the page after that angularjs constructed the final page.
I have heard about phantomjs but I'm not sure if this cover exactly my needs and maybe there is a easier or quicker way
Firefox and Chrome inspector give me the same view:
Finally, I have found that if I make a right click and "copy html" (chrome) or "edit" firefox. I can see the raw source code which show me what is actually escaped:
For the little story, I have found this by wanting to copy the extract of code in a comment on security.stackexchange.com ^^
document.outerHTMLcontains the closest thing to what's described, there's no point in looking at it: If you don't see the alert, the script is safe...