What problem does it solve? JavaScript applications that deep-merge user input into objects can be polluted through __proto__ or constructor.prototype keys, leading to global state corruption, logic bypass, or RCE. This Skill provides a structured playbook to detect, confirm, and exploit prototype pollution in both client-side and server-side JavaScript stacks during authorized security testing. ## Core Features & Use Cases - Client-Side Probing: URL fragment payloads (#__proto__[key]=value, #constructor[prototype][key]=value) with console verification of polluted Object.prototype properties. - Server-Side Black-Box Detection: A payload-to-signal table for Express/Node apps using qs or body-parser, mapping pollution keys like parameterLimit, json spaces, and status to observable response changes. - Gadget Chains: Exploitation patterns for EJS escapeFunction, Timelion-style expression chains (CVE-2019-7609), and Node child_process option pollution (NODE_OPTIONS, shell, env). - Use Case: During an authorized CTF or pentest, you find an endpoint that JSON-parses the request body and passes it to lodash.merge. Send {"__proto__":{"polluted":true}}, then issue a clean follow-up request to confirm global pollution, and escalate via a template-engine gadget toward RCE. ## Quick Start Test the target's JSON endpoint by sending a proto pollution payload and then a clean request to check whether Object.prototype was globally polluted.
