prototype-pollution

Prototype pollution detection involves analyzing application code for unsafe object manipulation behavior in merge utilities and template engines. It identifies unsafe prototype traversal patterns, validates the pollution impact, and documents affected endpoints and gadget chain risks.

A prototype pollution gadget chain maps potential exploitation paths involving template engines, sanitizers, and framework internals. Altering application behavior through unsafe object manipulation creates paths that can lead to XSS, RCE, or privilege-related flaws during security assessments.

Yes, you can examine browser-side pollution vectors including URL parameters, DOM interactions, and JavaScript object behavior. This client-side analysis identifies how unsafe prototype traversal patterns affect browser JavaScript execution and validates the associated pollution impact.

Yes, server-side detection tests both Node.js merge patterns and Python class pollution paths for unsafe object manipulation. It applies controlled analysis to identify unsafe prototype traversal patterns across these different server-side environments during authorized security testing.

Validating prototype pollution impact requires documenting affected endpoints and gadget chain risks discovered during authorized penetration testing. You map the potential exploitation paths involving template engines, sanitizers, and framework internals to record the specific unsafe object manipulation behavior.

You should use prototype pollution detection during authorized penetration testing scenarios involving Node.js, Python, browser JavaScript, merge utilities, template engines, and client-side frameworks. It applies controlled analysis of object manipulation behavior to identify vulnerabilities that alter application behavior.