skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

exploiting-prototype-pollution-in-javascript

Detect and exploit JavaScript prototype pollution vulnerabilities in client-side and server-side applications.

4|Updated Apr 28, 2026
Search Tags:#javascript#penetration testing#node.js#web security#rce#dom xss#prototype pollution
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill exploiting-prototype-pollution-in-javascript-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-prototype-pollution-in-javascript
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/exploiting-prototype-pollution-in-javascript
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill exploiting-prototype-pollution-in-javascript-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve? JavaScript applications that deep-merge user-controlled JSON can let attackers inject properties into Object.prototype, leading to DOM XSS, remote code execution, and authorization bypass. This Skill provides a structured workflow to find pollution sources, identify exploitable gadgets, and confirm impact with evidence. ## Core Features & Use Cases - Client-Side Detection and Exploitation: Test URL and hash-based pollution vectors, use DOM Invader to find gadgets, and achieve DOM XSS through sinks like innerHTML and jQuery $.html(). - Server-Side Exploitation: Send proto and constructor.prototype JSON payloads to Node.js APIs, then escalate to RCE via EJS, Pug, and Handlebars template gadgets or child_process properties. - Automated Scanning Script: Run the bundled Python agent to test JSON and query-parameter pollution over HTTP and statically scan JavaScript source files for dangerous merge patterns like lodash _.merge and jQuery deep extend. - Use Case: During an authorized assessment of a Node.js API, send {"proto": {"status": 510}} to a merge endpoint; if the response status changes to 510, server-side pollution is confirmed, then chain an EJS escapeFunction gadget to demonstrate RCE. ## Quick Start Ask the agent to test the target API endpoint for prototype pollution using the bundled scanning script and report any confirmed gadgets with their impact.

Frequently Asked Questions about exploiting-prototype-pollution-in-javascript

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for prototype pollution in a Node.js API?▼

Send a JSON body containing {"__proto__": {"status": 510}} to endpoints that merge objects. If the response status changes to 510, server-side pollution is confirmed. You can also test constructor.prototype paths and observe error responses.

What tools detect client-side prototype pollution?▼

DOM Invader, built into Burp Suite's browser, auto-detects pollution sources and scans for exploitable gadgets. The ppfuzz fuzzer and Nuclei prototype-pollution templates provide automated detection across multiple URLs.

Can prototype pollution lead to remote code execution?▼

Yes, when polluted properties reach dangerous sinks. Gadgets in EJS, Pug, and Handlebars template engines or child_process options like shell and NODE_OPTIONS can execute arbitrary commands on the server.

Which JavaScript libraries are vulnerable to prototype pollution?▼

Deep merge functions are the main risk: lodash _.merge and _.defaultsDeep, jQuery $.extend(true, ...), and Hoek.merge. Native Object.assign is lower risk because it only performs shallow copies.

How do I prevent prototype pollution in my application?▼

Reject __proto__, constructor, and prototype keys in user input, use Object.create(null) or Map for user-controlled data, and freeze Object.prototype. Update vulnerable packages such as lodash to version 4.17.12 or later.

Related Skills

Explore More Software Engineering Skills→
securityfortechsecurityfortech
6

web-fingerprinting

Identify web server type, frameworks, and versions via banner and header analysis.

Official
Intermediate
NabilThangeNabilThange
1

red-team-tactics

Guide red team exercises using MITRE ATT&CK attack phases and techniques.

Community
Intermediate
gerald-icagerald-ica

Cross-Site Scripting and HTML Injection Testing

Detect and exploit stored, reflected, and DOM-based XSS vulnerabilities in web applications.

Community
Advanced
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

semgrep-rule-creator

Generate custom Semgrep YAML rules for security vulnerability detection.

Official
Advanced