Prototype Pollution Hunting

Hunt for prototype pollution vulnerabilities where user-supplied properties merge into Object.prototype, affecting all objects in the runtime. Client-side pollution enables DOM XSS, cookie manipulation, and auth bypass. Server-side pollution chains to RCE via gadget chains in template engines (EJS, Pug, Handlebars) and CLI wrappers (child_process, NODE_OPTIONS).

When to Use

• Application uses JavaScript/Node.js with object merge, clone, or extend operations on user input.
• jQuery $.extend(true, ...) or $.fn.merge() with deep copy on untrusted data.
• Lodash _.merge(), _.defaultsDeep(), _.set() receiving request body/query params.
• Template engines (EJS, Pug, Handlebars) in the same runtime as user-controlled objects.
• Server-side Node.js with child_process.exec/spawn accessible via polluted options.

Quick Detection

# client-side: pollute via query param
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/page?__proto__[polluted]=true"