skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-prototype-pollution

Detect prototype pollution vulnerabilities in JavaScript and Node.js applications.

1.1k|191|Updated Jun 24, 2026
Search Tags:#xss#javascript#web-security#nodejs#rce#prototype-pollution#vulnerability-hunting
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-prototype-pollution
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-prototype-pollution
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-prototype-pollution
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-prototype-pollution

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prototype pollution in JavaScript and Node.js applications is a high-severity vulnerability that allows attackers to modify shared object prototypes, leading to client-side DOM XSS, authentication bypass, and server-side remote code execution, but it is frequently missed during standard security assessments.

Core Features & Use Cases

  • Client-side pollution detection: Identifies vulnerable object merge, clone, or extend operations in common libraries like jQuery and Lodash that process untrusted user input without proper property checks.
  • Server-side RCE chaining: Tests for exploitation of gadget chains in template engines (EJS, Pug, Handlebars) and Node.js CLI wrappers to achieve arbitrary code execution on the server.
  • Filter bypass and validation: Includes techniques to evade WAF rules blocking prototype pollution payloads, and provides verification steps to confirm if polluted properties actually impact application behavior. Use case: For a Node.js web application that uses Lodash to merge user request data into configuration objects, use this skill to test for prototype pollution, confirm if injected properties are accessible in the application runtime, and chain to RCE if server-side execution sinks are present.

Quick Start

Use the hunt-prototype-pollution skill to test the target API endpoint https://target.com/api/config for server-side prototype pollution vulnerabilities that could enable remote code execution.

Frequently Asked Questions about hunt-prototype-pollution

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for prototype pollution in a Node.js application?▼

To test for prototype pollution in a Node.js application, you identify vulnerable merge operations in libraries like Lodash or jQuery that process untrusted input, then verify if injected properties modify the application runtime.

What is prototype pollution and how does it lead to remote code execution?▼

Prototype pollution is a JavaScript vulnerability where user-supplied input modifies shared object prototypes like Object.prototype. Attackers chain this server-side with template engine gadget chains in EJS, Pug, or Handlebars to achieve RCE.

Can prototype pollution on the client side cause DOM XSS and authentication bypass?▼

Yes, client-side prototype pollution can cause DOM XSS and authentication bypass. When untrusted input merges into Object.prototype via vulnerable libraries, attackers manipulate cookies or DOM elements to bypass auth.

How do I bypass WAF rules blocking prototype pollution payloads?▼

You bypass WAF rules blocking prototype pollution payloads by applying filter bypass techniques during the merge operation. This involves using alternative property syntax or encoding methods to evade detection while polluting Object.prototype.

Does jQuery have vulnerable merge operations that allow prototype pollution?▼

Yes, jQuery has vulnerable merge and extend operations that allow prototype pollution if they process untrusted user input without proper property checks. This can lead to client-side DOM XSS and cookie manipulation.

How do I confirm if a polluted property actually impacts application behavior?▼

To confirm if a polluted property impacts application behavior, you validate exploitation via second-order pollution and gadget chain sinks. This verifies that injected properties on Object.prototype are accessible and trigger execution in the runtime context.

Related Skills

Explore More Software Engineering Skills→
jinyimeng01jinyimeng01
54

prototype-pollution

Detects prototype pollution vulnerabilities in Node.js, Python, and browser JavaScript.

Community
Advanced
sayseven7sayseven7
11

prototype-pollution-advanced

Map prototype pollution findings to framework-specific escalation gadgets.

Community
Advanced
lNwNllNwNl
2

prototype-pollution-advanced

Escalate prototype pollution into RCE or XSS via framework-specific gadget chains.

Community
Advanced
cajiascajias

typescript-eslint-object-injection-fix

Rewrite TypeScript dynamic key assignments to prevent ESLint detect-object-injection warnings.

Community
Intermediate