[EXPERT] Reflected XSS with AngularJS sandbox escape without strings

What is AngularJS? We know that the AngularJS framework parses everything inside {{ }} as an AngularJS expression. Anything inside the curly braces is referred to as an AngularJS Expression. The Angul