Adapting AngularJS payloads to exploit real world applications

Gareth Heyes adapts AngularJS template-injection payloads to bypass real-world filters: lower-case conversion at Piwik and a no-quotes policy at Uber. Both flaws enabled account hijacking.