skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

prototype-pollution-advanced

Escalate prototype pollution into RCE or XSS via framework-specific gadget chains.

2|Updated May 15, 2026
Search Tags:#xss#security testing#rce#template injection#prototype pollution#nodejs child_process#filter bypass
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill prototype-pollution-advanced
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: prototype-pollution-advanced
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/prototype-pollution-advanced
Command: npx skills add https://github.com/lNwNl/Methodos --skill prototype-pollution-advanced

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you escalate a confirmed prototype pollution finding into practical impact by identifying the right framework gadget chain for RCE (server-side) or XSS (client-side), even when key filters on proto are present.

Core Features & Use Cases

  • Server-side escalation to RCE: Maps prototype pollution properties to high-signal template-engine and Node.js child_process exploitation paths (e.g., EJS/Pug/Handlebars and NODE_OPTIONS/shell/argv0 patterns).
  • Client-side gadget discovery for XSS: Connects deep-merge prototype pollution to common front-end sinks and DOM property behaviors (e.g., jQuery and Lodash template/sourceURL patterns).
  • Filter bypass and detection playbooks: Provides robust black-box detection methods and constructor.prototype/bracket-notation/key-encoding bypass strategies to confirm and reach the gadget.

Quick Start

After you confirm prototype pollution in your target, instruct the agent to use this Skill to select the most likely gadget from the target stack and produce an end-to-end escalation plan from probe to RCE/XSS.

Frequently Asked Questions about prototype-pollution-advanced

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I escalate confirmed prototype pollution to RCE in Node.js?▼

You escalate prototype pollution to RCE by mapping polluted properties to framework-specific gadgets, targeting Node.js child_process execution paths and template engines like EJS or Pug to achieve remote code execution.

What is the best way to achieve XSS from prototype pollution in browser applications?▼

Achieving XSS from prototype pollution involves connecting deep-merge vulnerabilities to front-end DOM sinks, targeting jQuery or Lodash template and sourceURL patterns to execute malicious client-side scripts.

How do I bypass __proto__ filters during prototype pollution exploitation?▼

Bypassing __proto__ filters during prototype pollution exploitation uses alternative property assignment strategies like constructor.prototype, bracket-notation, or key-encoding techniques to reach the gadget chain.

Does this prototype pollution escalation approach work with all template engines?▼

This prototype pollution escalation targets server-side Node.js applications using template engines like EJS, Pug, and Handlebars, mapping known property and trigger combinations to achieve remote code execution.

When do I need prototype pollution gadget selection?▼

You need prototype pollution gadget selection after confirming a merge-sink vulnerability, using framework-specific property mappings to transition from basic pollution to actionable RCE or XSS impact.

Related Skills

Explore More Software Engineering Skills→
AcczdyAcczdy
2

exploiting-prototype-pollution-in-javascript

Detect and test prototype pollution vulnerabilities in JavaScript applications.

Community
Advanced
RifteoRifteo
30

ssti-hunter

Detect, fingerprint, and exploit Server-Side Template Injection vulnerabilities in web applications.

Official
Advanced
elementalsoulselementalsouls
3.3k

hunt-nodejs

Map Node.js vulnerability chains to remote code execution sinks.

Community
Advanced
vitoropereiravitoropereira

Cross-Site Scripting and HTML Injection Testing

Detect stored, reflected, and DOM-based XSS and HTML injection vulnerabilities in web applications.

Community
Advanced