Security audit and pentesting guide for Angular applications. Use this skill whenever you need to assess Angular app security, look for XSS vulnerabilities, check for bypassSecurityTrust misuse, audit template injection risks, test for open redirects, or review Angular security configurations. Trigger this for any Angular security review, code audit, or vulnerability assessment of Angular/TypeScript frontend applications.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Security audit and pentesting guide for Angular applications. Use this skill whenever you need to assess Angular app security, look for XSS vulnerabilities, check for bypassSecurityTrust misuse, audit template injection risks, test for open redirects, or review Angular security configurations. Trigger this for any Angular security review, code audit, or vulnerability assessment of Angular/TypeScript frontend applications.
Angular Security Audit Skill
A comprehensive guide for security professionals to audit and pentest Angular applications for common vulnerabilities.
Quick Start Checklist
Run through these checks first:
Sourcemaps disabled - Check angular.json for sourceMap.scripts: false
No bypassSecurityTrust with user input - Search for bypassSecurityTrust* calls
No direct DOM manipulation - Check for ElementRef.nativeElement, Renderer2.setAttribute
No jQuery with user input - Look for $.html(), $.parseHTML() with untrusted data
No unsafe location manipulation - Check window.location.*, document.location.* with user input
Template expressions escaped - Verify user input isn't concatenated into templates
SecurityContext used correctly - Ensure proper context for sanitization
Angular Architecture Overview
Understanding the structure helps identify attack surfaces:
// Angular Router - stays within domainthis.router.navigate(['/path']);
this.location.go('/path'); // Also internal only
Security Context Reference
Angular uses 6 security contexts for sanitization:
Context
Use Case
Example
None
No sanitization
Never use with user input
HTML
HTML content
[innerHTML]="value"
STYLE
CSS properties
[style]="value"
URL
URL attributes
[href]="value"
SCRIPT
JavaScript code
Rarely used
RESOURCE_URL
Executable resources
<script src>
Critical: Using wrong context = vulnerability
// WRONG - URL context on HTML
sanitizer.bypassSecurityTrustUrl("<script>alert(1)</script>");
// CORRECT - HTML context for HTML
sanitizer.bypassSecurityTrustHtml("<h1>Safe</h1>");
Audit Workflow
Phase 1: Reconnaissance
Check sourcemaps:
curl -I https://app.com/main.js | grep sourceMappingURL
curl https://app.com/main.js.map # If exists, download and analyze
Review angular.json:
"sourceMap":{"scripts":false,// Should be false in production"styles":false,"vendor":false,"hidden":true}
// BEFOREthis.elementRef.nativeElement.innerHTML = userInput;
// AFTER - Use Angular binding<div [innerHTML]="sanitizedInput"></div>// Or use Renderer2 safelythis.renderer2.setProperty(element, 'textContent', userInput);
// BEFORE
$("p").html(userInput);
// AFTER - Use textContent or Angular binding
$("p").text(userInput); // Escapes HTML// Or better: use Angular's [textContent] binding
Remember: Angular's default security is strong. Most vulnerabilities come from developers bypassing protections or using unsafe APIs. Focus your audit on those bypass points and direct DOM manipulation.
