PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Widespread prototype pollution gadgets

portswigger.net | research | #web-security | #prototype-pollution | #dom-invader | #gadgets | #client-side | #javascript-apis
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Client-side prototype pollution gadgets in browser APIs: polluting Object.prototype can inject fetch bodies or defeat Object.defineProperty locks, with similar gadgets found across common libraries.
Published
Collected

Related coverage

blog · portswigger.net
Finding client-side prototype pollution with DOM Invader
DOM Invader has been upgraded to detect client-side prototype pollution (CSPP) in a couple of clicks. The post explains pollution sources, gadgets, and how the tool finds and exploits them.
research · portswigger.net
XSS without HTML: Client-Side Template Injection with AngularJS
Gareth Heyes explains client-side template injection in AngularJS and presents a fresh sandbox escape affecting Angular 1.3.1+ and 1.4.0+, enabling XSS even when user input is HTML-encoded.
research · portswigger.net
WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine
WebSocket Turbo Intruder brings Turbo Intruder's fast engine to WebSocket testing, fuzzing messages at high speed with smart filtering to uncover races, prototype pollution and access-control bugs.
research · portswigger.net
Bypassing CSP via DOM clobbering
How to turn HTML injection into a CSP bypass via DOM clobbering: with a gadget like script.src reaching an allowed sink under strict-dynamic, injected scripts can run; DOM Invader can detect it.
research · portswigger.net
Server-side prototype pollution: Black-box detection without the DoS
Safe black-box detection methods for server-side prototype pollution that avoid breaking the server: encoding tricks, JSON spaces, exposed headers and other signals, shipped as a Burp extension.
research · portswigger.net
Exploiting prototype pollution in Node without the filesystem
A new SSPP exploitation technique: Node's --import flag accepts data: URLs, so polluting NODE_OPTIONS runs arbitrary code without touching the filesystem; Node considers this out of scope.
Back