PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

White-box penetration testing: How to debug for JavaScript vulnerabilities

yeswehack.com | blog | #pentesting | #prototype-pollution | #docker | #debugging | #javascript | #white-box
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Guide to white-box pentesting of JavaScript apps in Docker: debugging in VS Code to trace payloads, plus common flaws — prototype pollution (CWE-1321), type confusion and XSS.
Published
Collected

Related coverage

blog · yeswehack.com
White-box penetration testing: Debugging for Python vulnerabilities
Guide to white-box pentesting of Python apps in Docker: debugging in VS Code to track payloads, covering prototype pollution, template injection (CWE-1336) and path traversal.
blog · yeswehack.com
White-box penetration testing with Xdebug: Debugging for PHP vulnerabilities
Guide to white-box pentesting of PHP apps with Xdebug: setting up Docker and VS Code debugging to find file inclusion, regex errors and unsafe uploads, and craft new payloads.
blog · jfrog.com
Where Severity Scores Go Wrong: “Just Add Prototype Pollution”
JFrog researchers show how CVSS overstates risk using JavaScript prototype pollution as a case study — Axios gadget chains included — after reassessing 96% of NVD criticals as lower severity.
research · netspi.com
Prototype Pollution: A Deep-Dive
A deep dive into JavaScript prototype pollution: how attackers control undeclared variables to turn weakly-typed checks into XSS on the client side or remote code execution on the server side.
blog · yeswehack.com
Why pentests cause security debt
New features ship, dependencies update, new APIs are added… and all the while, despite your pentest program, security debt mounts up.
blog · yeswehack.com
Pentests are dead. Long live pentests.
Traditional pentests have created a cottage industry of painful admin. So what needs to change?
Back