> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xss/dom-xss-in-angularjs-with-encoded-angle-brackets-and-quotes.md).
# 带有编码尖括号和引号的 AngularJS 中的 DOM XSS
### AngularJS 表达式中尖括号和双引号经 HTML 编码的 DOM XSS
此活动展示了搜索功能使用的 AngularJS 表达式中的一个 XSS DOM 漏洞。AngularJS 会分析包含以下内容的 HTML 节点 `ng-app` 指令，并允许你评估双括号中的表达式 `{{ }}` —— 即使在以下情况下也可被滥用来运行 JavaScript `<` 和 `>` 尖括号和引号已在 HTML 端进行编码。实验目标：注入一个可运行的 AngularJS 表达式 `alert()`.
* 使用 Wappalyzer 进行站点分析表明存在 AngularJS。
* All The ThingsPayloads 资源包含适用于此案例的有用载荷（下方提供示例）。
测试的载荷
```javascript
{{constructor.constructor('alert(1)')()}}
```
```
{{[].pop.constructor('alert/u00281/u0029')()}}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/xss/dom-xss-in-angularjs-with-encoded-angle-brackets-and-quotes.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.