hunt-nodejs

Send JSON bodies containing __proto__ or constructor.prototype keys to endpoints that merge objects, then check whether subsequent responses reflect the polluted properties. Confirmation means the key appears in later API responses without being sent directly.

Pollute properties that reach dangerous sinks such as child_process options, lodash template sourceURL, or EJS outputFunctionName. Validate execution with an out-of-band callback to an Interactsh host or by observing command output in the response.

When Express has trust proxy enabled, the app trusts X-Forwarded-For headers, letting attackers spoof IPs to bypass allowlists or rate limits. Test by sending requests with X-Forwarded-For set to 127.0.0.1 or rotating addresses and observing whether restrictions are bypassed.

EJS, Pug, and Handlebars can all be exploited when user input reaches the template context. EJS allows direct payload execution like process.mainModule.require('child_process').execSync, while Handlebars typically requires a prototype pollution chain through helper lookups.

Yes, if the application has a local file inclusion flaw, reading /proc/self/environ exposes all environment variables of the Node.js process, which often include database credentials and cloud keys like AWS_ACCESS_KEY_ID.