Awesome Open Source
Awesome Open Source

AngularJS Client-Side Template Injection Logo
Donate via Bunq Build Status License: MIT

Angular Client-Side Template Injection Scanner

ACSTIS helps you to scan certain web applications for AngularJS Client-Side Template Injection (sometimes referred to as CSTI, sandbox escape or sandbox bypass). It supports scanning a single request but also crawling the entire web application for the AngularJS CSTI vulnerability.

Table of contents


First make sure you're on Python 2.7/3.4 or higher. Then run the command below to install ACSTIS.

$ pip install


Scan a single URL

acstis -d ""

Scan a single URL (and verify that the alert pops)

acstis -vp -d ""

Scan an entire domain

acstis -c -d ""

Scan an entire domain (and stop if a vulnerability was found)

acstis -c -siv -d ""

Trust the given certificate

acstis -d "" -tc "/Users/name/Desktop/cert.pem"

All command line options

usage: acstis [-h] -d DOMAIN [-c] [-vp] [-av ANGULAR_VERSION] [-vrl VULNERABLE_REQUESTS_LOG] [-siv] [-pmm] [-sos] [-soh] [-sot] [-md MAX_DEPTH] [-mt MAX_THREADS] [-iic] [-tc TRUSTED_CERTIFICATES]

required arguments:
   -d DOMAIN, --domain DOMAIN                                                       the domain to scan (e.g.

optional arguments:
   -h, --help                                                                       show this help message and exit
   -c, --crawl                                                                      use the crawler to scan all the entire domain
   -vp, --verify-payload                                                            use a javascript engine to verify if the payload was executed (otherwise false positives may occur)
   -av ANGULAR_VERSION, --angular-version ANGULAR_VERSION                           manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work
   -vrl VULNERABLE_REQUESTS_LOG, --vulnerable-requests-log VULNERABLE_REQUESTS_LOG  log all vulnerable requests to this file (e.g. /var/logs/acstis.log or urls.log)
   -siv, --stop-if-vulnerable                                                       (crawler option) stop scanning if a vulnerability was found
   -pmm, --protocol-must-match                                                      (crawler option) only scan pages with the same protocol as the startpoint (e.g. only https)
   -sos, --scan-other-subdomains                                                    (crawler option) also scan pages that have another subdomain than the startpoint
   -soh, --scan-other-hostnames                                                     (crawler option) also scan pages that have another hostname than the startpoint
   -sot, --scan-other-tlds                                                          (crawler option) also scan pages that have another tld than the startpoint
   -md MAX_DEPTH, --max-depth MAX_DEPTH                                             (crawler option) the maximum search depth (default is unlimited)
   -mt MAX_THREADS, --max-threads MAX_THREADS                                       (crawler option) the maximum amount of simultaneous threads to use (default is 20)
   -iic, --ignore-invalid-certificates                                              (crawler option) ignore invalid ssl certificates
   -tc TRUSTED_CERTIFICATES, --trusted-certificates TRUSTED_CERTIFICATES            (crawler option) trust this CA_BUNDLE file (.pem) or directory with certificates

Authentication, Cookies, Headers, Proxies & Scope options

These options are not implemented in the command line interface of ACSTIS. Please download the script and extend it with one or more of the following code snippets. You can paste these code snippets in the main() method of the script.

Please note: if you use the file make sure you call python [your arguments] instead of acstis [your arguments].

Basic Authentication

options.identity.auth = HTTPBasicAuth("username", "password")

Digest Authentication

options.identity.auth = HTTPDigestAuth("username", "password")


options.identity.cookies.set(name='tasty_cookie', value='yum', domain='', path='/cookies')
options.identity.cookies.set(name='gross_cookie', value='blech', domain='', path='/elsewhere')


    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"


options.identity.proxies = {
    # No authentication
    # 'http': 'http://host:port',
    # 'https': 'http://host:port',

    # Basic authentication
    # 'http': 'http://user:[email protected]:port',
    # 'https': 'https://user:[email protected]:port',

    # SOCKS
    'http': 'socks5://user:[email protected]:port',
    'https': 'socks5://user:[email protected]:port'

Scope options

options.scope.protocol_must_match = False

options.scope.subdomain_must_match = True

options.scope.hostname_must_match = True

options.scope.tld_must_match = True

options.scope.max_depth = None

options.scope.request_methods = [


The testing can and will automatically be done by Travis CI on every push. If you want to manually run the unit tests, use the command below.

$ python -m unittest discover


Issues or new features can be reported via the GitHub issue tracker. Please make sure your issue or feature has not yet been reported by anyone else before submitting a new one.


ACSTIS is open-sourced software licensed under the MIT license.

Related Awesome Lists
Top Programming Languages
Top Projects

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
Python (821,670
Security (31,799
Angularjs (11,927
Certificate (11,220
Crawler (10,174
Xss (1,730
Vulnerability Scanners (527
Xss Scanner (54
Sandbox Escape (3