[{"_1":2,"_152":-5,"_153":-5},"loaderData",{"_3":4,"_13":14,"_20":21,"_131":132},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","routes/_layout.r.$namespace.$reponame",{"_22":23,"_24":-5,"_25":11,"_26":11,"_27":28,"_29":30,"_31":-5,"_32":11,"_33":34,"_83":-5,"_84":85,"_124":-5,"_125":11,"_126":17,"_127":11,"_128":-5,"_129":130},"canonicalUrl","https://hub.docker.com/r/txt3rob/angularjs-csti-scanner/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","txt3rob","reponame","angularjs-csti-scanner","cloudBuildSource","isAutobuildsAvailable","repo",{"_35":36,"_37":38,"_40":41,"_42":43,"_44":11,"_45":46,"_47":48,"_49":50,"_52":30,"_27":28,"_53":54,"_55":39,"_56":57,"_58":57,"_59":60,"_61":-5,"_62":63,"_64":65,"_66":11,"_67":28,"_68":69,"_74":17,"_75":76,"_80":28,"_81":82},"categories",[],"content_types",[39],"image","date_registered","2017-10-26T09:17:54.433985Z","description","ACSTIS helps you to scan certain web applications for AngularJS Client-Side Template Injection","is_private","last_updated","2020-03-26T13:50:24.225821Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[51],"application/vnd.docker.container.image.v1+json","name","pull_count",1197,"repository_type","star_count",1,"status","status_description","active","source","collaborator_count",0,"full_description",".. raw:: html\n\n

\n\n.. image:: https://rawgit.com/tijme/angularjs-csti-scanner/master/.github/logo.svg?pypi=png.from.svg\n :width: 300px\n :height: 300px\n :alt: AngularJS Client-Side Template Injection Logo\n\n.. raw:: html\n\n
\n\n.. image:: https://travis-ci.org/tijme/angularjs-csti-scanner.svg?branch=master\n :target: https://travis-ci.org/tijme/angularjs-csti-scanner\n :alt: Build Status\n\n.. image:: https://img.shields.io/pypi/l/acstis.svg\n :target: https://github.com/tijme/acstis/blob/master/LICENSE.rst\n :alt: License: MIT\n\n.. raw:: html\n\n

Docker Version Of Angular Client-Side Template Injection Scanner

\n\n \n \nACSTIS helps you to scan certain web applications for AngularJS Client-Side Template Injection (sometimes referred to as CSTI, sandbox escape or sandbox bypass). It supports scanning a single request but also crawling the entire web application for the AngularJS CSTI vulnerability.\n\nTable of contents\n-----------------\n\n- `Installation <#installation>`__\n- `Usage <#usage>`__\n- `Issues <#issues>`__\n- `License <#license>`__\n\nInstallation\n------------\n\ndocker run -it txt3rob/angularjs-csti-scanner\n\n\nUsage\n-----\n\n**Scan a single URL**\n\n``acstis -d \"https://finnwea.com/some/page/?category=23\"``\n\n**Scan a single URL (and verify that the alert pops)**\n\n``acstis -vp -d \"https://finnwea.com/some/page/?category=23\"``\n\n**Scan an entire domain**\n\n``acstis -c -d \"https://finnwea.com/\"``\n\n**Scan an entire domain (and stop if a vulnerability was found)**\n\n``acstis -c -siv -d \"https://finnwea.com/\"``\n\n**Trust the given certificate**\n\n``acstis -d \"https://finnwea.com/some/page/?category=23\" -tc \"/Users/name/Desktop/cert.pem\"``\n\n**All command line options**\n\n.. code:: text\n\n usage: acstis [-h] -d DOMAIN [-c] [-vp] [-av ANGULAR_VERSION] [-pmm] [-sos] [-soh] [-sot] [-siv] [-md MAX_DEPTH] [-mt MAX_THREADS]\n\n required arguments:\n -d DOMAIN, --domain DOMAIN the domain to scan (e.g. finnwea.com)\n\n optional arguments:\n -h, --help show this help message and exit\n -c, --crawl use the crawler to scan all the entire domain\n -vp, --verify-payload use a javascript engine to verify if the payload was executed (otherwise false positives may occur)\n -av ANGULAR_VERSION, --angular-version ANGULAR_VERSION manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work\n -pmm, --protocol-must-match (crawler option) only scan pages with the same protocol as the startpoint (e.g. only https)\n -sos, --scan-other-subdomains (crawler option) also scan pages that have another subdomain than the startpoint\n -soh, --scan-other-hostnames (crawler option) also scan pages that have another hostname than the startpoint\n -sot, --scan-other-tlds (crawler option) also scan pages that have another tld than the startpoint\n -siv, --stop-if-vulnerable (crawler option) stop scanning if a vulnerability was found\n -md MAX_DEPTH, --max-depth MAX_DEPTH (crawler option) the maximum search depth (default is unlimited)\n -mt MAX_THREADS, --max-threads MAX_THREADS (crawler option) the maximum amount of simultaneous threads to use (default is 8)\n -iic, --ignore-invalid-certificates (crawler option) ignore invalid ssl certificates\n -tc TRUSTED_CERTIFICATES, --trusted-certificates TRUSTED_CERTIFICATES (crawler option) trust this CA_BUNDLE file (.pem) or directory with certificates\n\n**Authentication, Cookies, Headers, Proxies & Scope options**\n\nThese options are not implemented in the command line interface of ACSTIS. Please download the `extended.py `_ script and extend it with one or more of the following code snippets. You can paste these code snippets in the `main()` method of the `extended.py` script.\n\n**Please note:** if you use the ``extended.py`` file make sure you call ``python extended.py [your arguments]`` instead of ``acstis [your arguments]``.\n\n*Basic Authentication*\n\n.. code:: python\n\n options.identity.auth = HTTPBasicAuth(\"username\", \"password\")\n\n*Digest Authentication*\n\n.. code:: python\n\n options.identity.auth = HTTPDigestAuth(\"username\", \"password\")\n\n*Cookies*\n\n.. code:: python\n\n options.identity.cookies.set(name='tasty_cookie', value='yum', domain='finnwea.com', path='/cookies')\n options.identity.cookies.set(name='gross_cookie', value='blech', domain='finnwea.com', path='/elsewhere')\n\n*Headers*\n\n.. code:: python\n\n options.identity.headers.update({\n \"User-Agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36\"\n })\n\n*Proxies*\n\n.. code:: python\n\n options.identity.proxies = {\n # No authentication\n # 'http': 'http://host:port',\n # 'https': 'http://host:port',\n\n # Basic authentication\n # 'http': 'http://user:pass@host:port',\n # 'https': 'https://user:pass@host:port',\n\n # SOCKS\n 'http': 'socks5://user:pass@host:port',\n 'https': 'socks5://user:pass@host:port'\n }\n\n*Scope options*\n\n.. code:: python\n\n options.scope.protocol_must_match = False\n\n options.scope.subdomain_must_match = True\n\n options.scope.hostname_must_match = True\n\n options.scope.tld_must_match = True\n\n options.scope.max_depth = None\n\n options.scope.request_methods = [\n Request.METHOD_GET,\n Request.METHOD_POST,\n Request.METHOD_PUT,\n Request.METHOD_DELETE,\n Request.METHOD_OPTIONS,\n Request.METHOD_HEAD\n ]\n\nTesting\n-------\n\nThe testing can and will automatically be done by `Travis CI `__ on every push. If you want to manually run the unit tests, use the command below.\n\n``$ python -m unittest discover``\n\nLicense\n-------\n\nACSTIS is open-sourced software licensed under the `MIT license `__.\n","has_starred","hub_user","immutable_tags_settings",{"_70":11,"_71":72},"enabled","rules",[73],".*","is_automated","permissions",{"_77":17,"_78":11,"_79":11},"read","write","admin","user","storage_size",7138344099,"orgData","recentTags",[86],{"_87":39,"_88":89,"_90":91,"_92":93,"_94":95,"_45":113,"_114":89,"_115":28,"_116":51,"_52":117,"_118":119,"_120":104,"_121":113,"_122":60,"_123":17},"content_type","creator",521350,"full_size",530538607,"id",17102955,"images",[96],{"_97":98,"_99":100,"_101":102,"_103":104,"_105":106,"_107":108,"_109":102,"_110":-5,"_111":91,"_58":60,"_112":-5},"architecture","amd64","digest","sha256:16629b177f854f0d89c1e81de249e437940af3b834bf3af3b591c5a3b79e60a9","features","","last_pulled","2026-09-09T21:41:41.040858927Z","last_pushed","2020-03-26T13:50:24Z","os","linux","os_features","os_version","size","variant","2020-03-26T13:50:23.678936Z","last_updater","last_updater_username","media_type","latest","repository",1988289,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_33":133,"_140":141,"_129":150,"_151":11},{"_35":134,"_37":135,"_40":41,"_42":43,"_44":11,"_45":46,"_47":48,"_49":136,"_52":30,"_27":28,"_53":54,"_55":39,"_56":57,"_58":57,"_59":60,"_61":-5,"_62":63,"_64":65,"_66":11,"_67":28,"_68":137,"_74":17,"_75":139,"_80":28,"_81":82},[],[39],[51],{"_70":11,"_71":138},[73],{"_77":17,"_78":11,"_79":11},"tags",{"_142":57,"_143":-5,"_144":-5,"_145":146},"count","next","previous","results",[147],{"_87":39,"_88":89,"_90":91,"_92":93,"_94":148,"_45":113,"_114":89,"_115":28,"_116":51,"_52":117,"_118":119,"_120":104,"_121":113,"_122":60,"_123":17},[149],{"_97":98,"_99":100,"_101":102,"_103":104,"_105":106,"_107":108,"_109":102,"_110":-5,"_111":91,"_58":60,"_112":-5},[],"canDeleteTags","actionData","errors"]

txt3rob/angularjs-csti-scanner

Tags for txt3rob/angularjs-csti-scanner