PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Server-side prototype pollution: Black-box detection without the DoS

portswigger.net | research | #web-security | #prototype-pollution | #detection | #nodejs | #black-box-testing | #burp-suite-extension
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Safe black-box detection methods for server-side prototype pollution that avoid breaking the server: encoding tricks, JSON spaces, exposed headers and other signals, shipped as a Burp extension.
Published
Collected

Related coverage

research · portswigger.net
Exploiting prototype pollution in Node without the filesystem
A new SSPP exploitation technique: Node's --import flag accepts data: URLs, so polluting NODE_OPTIONS runs arbitrary code without touching the filesystem; Node considers this out of scope.
vulnerability · yeswehack.com
Server side prototype pollution, how to detect and exploit
Server-side prototype pollution in JavaScript: how prototypes work, how to detect vulnerable targets in black-box testing, and gadget hunting in libraries such as Express, Fastify and Axios.
blog · aikido.dev
Preventing prototype pollution in your repository
Prototype pollution causes 20-30% of CVEs in JavaScript/npm stacks and can lead to RCE. The article covers why Node's --frozen-intrinsics isn't ready and how the nopp library mitigates it.
tool · github.com
node2shell-scanner: High-Fidelity Remote Detection Tool for Node.js Brotli OOB Write (CVE-2026-111497)
Provides defenders and security teams with a safe, non-destructive, and high-fidelity method to scan large attack surfaces and confirm Node.js exposure to the critical Brotli decoder flaw.
research · portswigger.net
WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine
WebSocket Turbo Intruder brings Turbo Intruder's fast engine to WebSocket testing, fuzzing messages at high speed with smart filtering to uncover races, prototype pollution and access-control bugs.
research · portswigger.net
Widespread prototype pollution gadgets
Client-side prototype pollution gadgets in browser APIs: polluting Object.prototype can inject fetch bodies or defeat Object.defineProperty locks, with similar gadgets found across common libraries.
Back