https://blog.sicks3c.io/tags/angular/Recent content in Angular on SicksecHugo -- gohugo.ioen© 2026 SicksecSun, 01 Aug 2021 00:00:00 +0000https://blog.sicks3c.io/posts/tale-of-xss-in-angular/Sun, 01 Aug 2021 00:00:00 +0000https://blog.sicks3c.io/posts/tale-of-xss-in-angular/<p><figure class="article-figure"> <img src="https://cdn-images-1.medium.com/max/800/0*67LG7dce-XrL1Pdk" alt="Angular XSS Featured Image" loading="lazy" decoding="async"> <figcaption>Angular XSS Featured Image</figcaption> </figure> </p> <p><strong>Hello Security Researchers and Hackers</strong></p> <p>In this writeup I explain how I found 2 rXSS vulnerabilities in Angular using automation.</p> <hr> <h2 id="tools-used">Tools Used<a class="heading-anchor" href="#tools-used" aria-label="Link to Tools Used">#</a></h2> <ul> <li><a href="https://findomain.app/" target="_blank" rel="noreferrer">Findomain</a> for subdomain monitoring</li> <li>Wappalyzer for technology detection</li> </ul> <hr> <h2 id="discovery-process">Discovery Process<a class="heading-anchor" href="#discovery-process" aria-label="Link to Discovery Process">#</a></h2> <ol> <li> <p>Received Telegram alert for new subdomains</p> </li> <li> <p>Identified Angular 1.6 using Wappalyzer</p> </li> <li> <p>Found reflected error parameter:</p> <p><code>https://redacted.com/Home/Error?error=USER_NOT_AUTHORIZED</code></p> </li> </ol> <hr> <h2 id="exploitation">Exploitation<a class="heading-anchor" href="#exploitation" aria-label="Link to Exploitation">#</a></h2> <p>Used payload from <a href="https://github.com/swisskyrepo/PayloadsAllTheThings" target="_blank" rel="noreferrer">PayloadsAllTheThings</a>:</p>