---
id: 5453
title: "Server-side prototype pollution: Black-box detection without the DoS"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/server-side-prototype-pollution"
published_at: "2023-03-28T09:50:00Z"
tags: ["web-security", "prototype-pollution", "detection", "nodejs", "black-box-testing", "burp-suite-extension"]
phying_url: "https://phying.com/item/5453"
lang: en
---

# Server-side prototype pollution: Black-box detection without the DoS

## Summary

Safe black-box detection methods for server-side prototype pollution that avoid breaking the server: encoding tricks, JSON spaces, exposed headers and other signals, shipped as a Burp extension.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2023-03-28T09:50:00Z
- **Original:** https://portswigger.net/research/server-side-prototype-pollution
- **Phying News:** https://phying.com/item/5453