Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Hunt for prototype pollution vulnerabilities where user-supplied properties merge into Object.prototype, affecting all objects in the runtime. Client-side pollution enables DOM XSS, cookie manipulation, and auth bypass. Server-side pollution chains to RCE via gadget chains in template engines (EJS, Pug, Handlebars) and CLI wrappers (child_process, NODE_OPTIONS).
When to Use
Application uses JavaScript/Node.js with object merge, clone, or extend operations on user input.
jQuery $.extend(true, ...) or $.fn.merge() with deep copy on untrusted data.
// Verify pollution in browser consoleObject.prototype.polluted// should return the injected value// DOM XSS via polluted options// If the app uses jQuery $.extend with polluted {url: "javascript:alert(1)"}// Auth bypass: pollute isAdmin// If the app checks if (user.isAdmin) without hasOwnProperty
Phase 5 — Second-Order Pollution
# Store pollution in database, triggered by background job
curl -sk -X POST "https://target.com/api/profile" \
-H "Content-Type: application/json" \
-d '{"name":{"__proto__":{"isAdmin":true}}}'# Later, when an admin views the profile or a cron job processes it,# the pollution triggers in that context
Pitfalls
Not every __proto__ in a request is a finding. Only report when the polluted property actually affects application behavior.
Node.js 12+ and newer lodash versions have partial mitigations. Test with older versions first.
Server-side pollution requires a gadget. Polluting random objects without reaching a sink (exec, eval, template) has no impact.
BlackFan's client-side prototype pollution catalog is the canonical reference — cross-check findings against it.
Verification
Inject __proto__[test]=value and verify Object.prototype.test === value in browser console or server response.
For RCE: confirm command execution produces output (id/whoami) in a visible sink.
For XSS: verify the polluted property reaches innerHTML, eval, document.write, or a script src attribute.
Document the exact merge/copy function and the polluted property chain.
Related Skills
hunt-nodejs — Node.js-specific vulnerabilities including prototype pollution in Express/Next.js.
hunt-xss — DOM XSS often exploitable through client-side prototype pollution.
hunt-api-misconfig — Object merge on request bodies without hasOwnProperty checks.
__proto__: Many parsers treat the literal key __proto__ as a magic key that attaches nested properties to the prototype chain. Merging {"__proto__": {"x": 1}} may be equivalent to Object.prototype.x = 1 (behavior varies by implementation and version).
constructor.prototype: constructor typically points to the object's constructor; constructor.prototype targets that constructor's prototype object. For plain objects this defaults to Object.prototype. Path: {"constructor":{"prototype":{"polluted":1}}}. Not always equivalent to __proto__ (filtering, JSON.parse, Bun/Node differences) — always test both.
Attack essence: In an un-isolated merge algorithm, attacker-controlled keys reach the prototype object, giving global or shared template contexts malicious properties. Subsequent code "normally" reads these properties and triggers gadgets.
JSON serialization responses show extra spaces (JSON.stringify polluted)
{"__proto__":{"exposedHeaders":["foo"]}}
CORS responses include foo-related headers
{"__proto__":{"status":510}}
A response status code changes to 510 or anomalous code
Operational: send pollution request first, then a clean follow-up request to check persistence. Connection pooling and worker lifecycle affect whether changes are globally visible.
Tools
Project
Purpose
yeswehack/pp-finder
Locate PP-prone merge points and patterns
yuske/silent-spring
Research and detect prototype pollution surfaces
yuske/server-side-prototype-pollution
Server-side PP test suite / methodology
BlackFan/client-side-prototype-pollution
Browser-side PP cases and payloads
portswigger/server-side-prototype-pollution
Burp ecosystem extension / supporting materials
msrkp/PPScan
Scanning / verification helper
ppfuzz
Automated prototype pollution fuzzer: ppfuzz -u URL -m POST
Decision Tree
Input merged into nested object?
(query, JSON, GraphQL vars, YAML→JSON)
|
NO --------------+-------------- YES
| |
Other vuln class Parser allows __proto__ /
constructor.prototype keys?
|
NO --------------+-------------- YES
| |
Check unicode / Confirm global effect:
bypass of key names clean follow-up request
| |
+--------------+----------------+
|
v
Gadget present? (template, spawn, JSON.stringify opts, CORS)
|
NO ------------------+------------------ YES
| |
Report PP as DoS / Build minimal RCE or
logic impact high-impact PoC
| |
+---------------------+-------------------+
|
v
Client-side: fragment / DOM / third-party script
Server-side: qs/body-parser/lodash/deep-merge version audit
