webPromedium
Lab 202 — WikiVault — AngularJS Client-Side Template Injection (XSS)
hackadvisor
Task: collaborative wiki platform with AngularJS 1.5.8 search page reflecting user input inside ng-app div without encoding curly braces; admin bot visits reported URLs. Solution: AngularJS CSTI with sandbox escape via charAt/trim override, Function constructor with String.fromCharCode to execute arbitrary JS, exfiltrate admin's non-HttpOnly flag cookie via same-origin comment POST.
$ ls tags/ techniques/
nodejssandbox_escapexsscookie_stealingexpressadmin_botcstiangularjsfunction_constructorsame_origin_exfiltrationclient_side_template_injectionfromcharcode
admin_bot_exploitationnon_httponly_cookie_theftangularjs_csti_sandbox_escapesame_origin_data_exfiltration_via_commentsfunction_constructor_arbitrary_jsstring_fromcharcode_parser_bypass
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 160 — WikiForge — Nginx Alias Path Traversal— hackadvisor
- [web][Pro]Lab 330 — AuthVault — Blind LDAP Injection in Directory Lookup— hackadvisor
- [web][Pro]Lanternfall— neurogrid
- [web][Pro]Lab 16 — FileGate — Authentication Bypass in API Login— hackadvisor
- [web][Pro]Lab 393 — ShareVault — Stored XSS via File Browser innerHTML— hackadvisor