skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

prototype-pollution

Tests JavaScript applications for prototype pollution via __proto__ and constructor.prototype injection paths.

Updated Jun 5, 2026
Search Tags:#javascript#penetration testing#node.js#web security#ctf#rce#prototype pollution
One-click install
npx skills add https://github.com/lNwNl/Praxis --skill prototype-pollution-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: prototype-pollution
Source: https://github.com/lNwNl/Praxis/tree/main/skills/prototype-pollution
Command: npx skills add https://github.com/lNwNl/Praxis --skill prototype-pollution-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? JavaScript applications that merge user input into objects through query parsers, JSON bodies, or deep-assign logic can be polluted via prototype chains, leading to global state corruption, template engine hijacking, or remote code execution. This Skill provides a structured playbook to detect, confirm, and exploit these vulnerabilities on authorized targets. ## Core Features & Use Cases - Dual-path probing: Covers both __proto__ and constructor.prototype injection vectors for client-side (URL fragments, DOM) and server-side (Express/qs/body-parser) targets. - Black-box detection table: Maps specific pollution payloads (e.g., parameterLimit, json spaces, status) to observable side effects in follow-up requests, enabling confirmation without source access. - Gadget chain guidance: Documents exploitation paths through EJS escapeFunction, child_process options, NODE_OPTIONS, and historical chains like CVE-2019-7609, plus a decision tree from detection to PoC. - Use Case: During an authorized web assessment, you notice the target parses nested query strings with qs and merges JSON bodies with lodash.merge. Use this Skill to send pollution probes, verify global impact with clean follow-up requests, and escalate to a template-engine RCE gadget. ## Quick Start Ask the agent to test the target's JSON and query parsing endpoints for prototype pollution using both proto and constructor.prototype payloads, then confirm impact with a clean follow-up request.

Frequently Asked Questions about prototype-pollution

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for prototype pollution in a Node.js application?▼

Send JSON payloads like {"__proto__":{"polluted":true}} and {"constructor":{"prototype":{"polluted":true}}} to endpoints that parse bodies or queries into objects. Then issue a clean follow-up request and check for abnormal status codes, JSON spacing, or header behavior indicating global pollution.

What is the difference between __proto__ and constructor.prototype pollution?▼

__proto__ is a magic key many parsers treat as a direct path to the object's prototype, while constructor.prototype reaches the prototype through the constructor function. They are not always equivalent due to filtering and parser differences, so both paths should be tested.

Which libraries are commonly vulnerable to prototype pollution?▼

The playbook flags lodash.merge, deep-extend, hoek applyToDefaults, and certain qs or query-string configurations as high-priority targets. Any recursive merge or Object.assign on parsed user input without key filtering is a candidate sink.

Can prototype pollution lead to remote code execution?▼

Yes, when polluted properties are later read as configuration by gadgets such as the EJS escapeFunction option or child_process spawn options like shell, env, or NODE_OPTIONS. Exploitation depends on the target's dependency versions and whether options are read from the prototype chain.

Why does my prototype pollution payload show no effect?▼

The parser may filter __proto__ keys, the merge logic may use hasOwnProperty checks, or the impact may only be visible in other workers or after connection pool resets. Try the constructor.prototype path, unicode key bypasses, and observe clean follow-up requests rather than the pollution response itself.

Related Skills

Explore More Software Engineering Skills→
lNwNllNwNl

prototype-pollution

Tests JavaScript applications for prototype pollution via __proto__ and constructor.prototype injection paths.

Community
Advanced
sayseven7sayseven7
11

prototype-pollution-advanced

Map prototype pollution findings to framework-specific escalation gadgets.

Community
Advanced
sayseven7sayseven7
11

injection-checking

Routes attack input to the appropriate specialized testing workflow based on sink type.

Community
Intermediate
dmbs335dmbs335
18

bchecks-generator

Generate Burp Suite BChecks and Bambdas from vulnerability taxonomy documents.

Community
Advanced