DOM XSS in AngularJS expression with angle brackets and double quotes HTML encoded

PreviousDOM XSS in document.write sink using source location.search inside a select element NextReflected DOM XSS

DOM XSS in AngularJS expression with angle brackets and double quotes HTML encoded

Description

This lab contains a vulnerability in a AngularJS expression within the search functionality.

AngularJS is a popular JavaScript library, which scans the contents of HTML nodes containing the ng-app attribute (also known as an AngularJS directive). When a directive is added to the HTML code, you can execute JavaScript expressions within double curly braces. This technique is useful when angle brackets are being encoded.

To solve this lab, perform a cross-site scripting attack that executes an AngularJS expression and calls the alert function.

Approach

After accessing the lab, I pressed CTRL+U to view the page's source code. I noticed the presence of the ng-app attribute, which indicates that the website is using the AngularJS framework. This information is crucial because AngularJS processes data bindings in a way that can potentially be exploited for XSS (Cross-Site Scripting) vulnerabilities.

In AngularJS, expressions are evaluated within double curly braces {{ }}. This feature can be exploited if user input is not properly sanitized. After researching AngularJS XSS payloads, I found this interesting payload:

{{constructor.constructor('alert(1)')()}}

Here's a detailed explanation of how this payload works:

Double Curly Braces {{ }}: In AngularJS, anything inside double curly braces is treated as an expression and is evaluated. By injecting an expression, we can execute arbitrary JavaScript code.
constructor.constructor: This part of the payload takes advantage of JavaScript's function constructor. The constructor property of an object references the function that created the instance's prototype. By chaining constructor.constructor, we can create a new function from a string of code. Essentially, this is equivalent to using eval, but it's a way to bypass certain restrictions.
alert(1): The string 'alert(1)' is passed to the function constructor, which creates a new function that executes alert(1). When this function is called, it triggers an alert box with the message 1.
(): Finally, the parentheses () execute the newly created function, causing the alert to be displayed.

By injecting this payload into the search bar, AngularJS processes the input and evaluates it as a JavaScript expression. The payload successfully triggers an alert box, solving the lab.

PreviousDOM XSS in document.write sink using source location.search inside a select element NextReflected DOM XSS

Description

This lab contains a vulnerability in a AngularJS expression within the search functionality.

To solve this lab, perform a cross-site scripting attack that executes an AngularJS expression and calls the alert function.

Approach

{{constructor.constructor('alert(1)')()}}

Here's a detailed explanation of how this payload works:

Double Curly Braces {{ }}: In AngularJS, anything inside double curly braces is treated as an expression and is evaluated. By injecting an expression, we can execute arbitrary JavaScript code.
constructor.constructor: This part of the payload takes advantage of JavaScript's function constructor. The constructor property of an object references the function that created the instance's prototype. By chaining constructor.constructor, we can create a new function from a string of code. Essentially, this is equivalent to using eval, but it's a way to bypass certain restrictions.
alert(1): The string 'alert(1)' is passed to the function constructor, which creates a new function that executes alert(1). When this function is called, it triggers an alert box with the message 1.
(): Finally, the parentheses () execute the newly created function, causing the alert to be displayed.

By injecting this payload into the search bar, AngularJS processes the input and evaluates it as a JavaScript expression. The payload successfully triggers an alert box, solving the lab.