---
id: 5541
title: "Adapting AngularJS payloads to exploit real world applications"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/adapting-angularjs-payloads-to-exploit-real-world-applications"
published_at: "2019-06-14T12:12:00Z"
tags: ["xss", "template-injection", "payloads", "uber", "angularjs", "piwik"]
phying_url: "https://phying.com/item/5541"
lang: en
---

# Adapting AngularJS payloads to exploit real world applications

## Summary

Gareth Heyes adapts AngularJS template-injection payloads to bypass real-world filters: lower-case conversion at Piwik and a no-quotes policy at Uber. Both flaws enabled account hijacking.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2019-06-14T12:12:00Z
- **Original:** https://portswigger.net/research/adapting-angularjs-payloads-to-exploit-real-world-applications
- **Phying News:** https://phying.com/item/5541