hunt-prototype-pollution

What problem does it solve?

Prototype pollution in JavaScript and Node.js applications is a high-severity vulnerability that allows attackers to modify shared object prototypes, leading to client-side DOM XSS, authentication bypass, and server-side remote code execution, but it is frequently missed during standard security assessments.

Core Features & Use Cases

• Client-side pollution detection: Identifies vulnerable object merge, clone, or extend operations in common libraries like jQuery and Lodash that process untrusted user input without proper property checks.
• Server-side RCE chaining: Tests for exploitation of gadget chains in template engines (EJS, Pug, Handlebars) and Node.js CLI wrappers to achieve arbitrary code execution on the server.
• Filter bypass and validation: Includes techniques to evade WAF rules blocking prototype pollution payloads, and provides verification steps to confirm if polluted properties actually impact application behavior. Use case: For a Node.js web application that uses Lodash to merge user request data into configuration objects, use this skill to test for prototype pollution, confirm if injected properties are accessible in the application runtime, and chain to RCE if server-side execution sinks are present.

Quick Start

Use the hunt-prototype-pollution skill to test the target API endpoint https://target.com/api/config for server-side prototype pollution vulnerabilities that could enable remote code execution.