domains / families / security / prototype-pollution

prototype-pollution

separate

Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring libraries via untrusted keys, or when hunting RCE gadgets via polluted Object.prototype in Node or the browser.

When to use

• Prototype pollution testing
• JavaScript stack security
• Client-side detection
• Server-side detection
• Exploitation gadgets
• Merge-sink detection
• RCE gadget hunting

Skill page

Source