Tale of XSS in Angular

Hello Security Researchers and Hackers

In this writeup I explain how I found 2 rXSS vulnerabilities in Angular using automation.

Tools Used#

• Findomain for subdomain monitoring
• Wappalyzer for technology detection

Discovery Process#

1. Received Telegram alert for new subdomains

2. Identified Angular 1.6 using Wappalyzer

3. Found reflected error parameter:

   https://redacted.com/Home/Error?error=USER_NOT_AUTHORIZED

Exploitation#

Used payload from PayloadsAllTheThings:

Key Takeaways#

• Demonstrate concrete impact for better severity rating
• Automate monitoring for fresh targets
• Know framework-specific vulnerabilities