AngularJS-specific Injection Detection

[heathj]

Yo.

A cool feature would be to detect AngularJS-based injection, a la https://hackerone.com/reports/141463.

A simple payload would be something like {{191*7}} and then watching for 1337 in the output, or something like that.

Bonus points for selecting the appropriate sandbox escape payload, if needed, though this probably goes against the spirit of your tool.

Jack

[robertmd]

There is really two ways of doing this. Jack's way or you could just look for reflected use input in a response

[heathj]

I still like this idea. I wish tracy would generate random math equations and look for their answers in the response as a tracy string