prototype-pollution-advanced

prototype-pollution-advanced is an offensive-security playbook for escalating a confirmed JavaScript prototype-pollution finding into higher-impact outcomes. It is positioned as a companion to a basic prototype-pollution skill and instructs loading that first for fundamentals such as merge sinks, the distinction between __proto__ and constructor.prototype, and basic probes. The material is intended for authorized penetration testing and covers both server-side and client-side exploitation.

On the server side it documents remote-code-execution paths through template engines such as EJS, Pug, Handlebars, and Nunjucks, as well as Express res.render and Node.js child_process gadgets that inherit polluted properties like shell, env, and NODE_OPTIONS. On the client side it catalogs gadgets in jQuery and Lodash, framework script gadgets (Angular.js, Vue.js, Ember.js, Backbone.js), and DOM property pollution that leads to XSS. A companion KNOWN_GADGETS.md reference tabulates gadgets by framework with polluted properties, trigger conditions, impact, and affected versions.

Use it after pollution is confirmed and the goal is code execution or framework-specific gadget discovery. It also provides systematic detection: black-box server-side probes using injected __proto__ payloads and error or response differentials (for example overwriting toString or valueOf to force crashes, or changing status and content-type), client-side checks against Object.prototype, and automated tooling including the PPScan and server-side-prototype-pollution Burp extensions plus the ppfuzz and ppmap CLIs. A dedicated section covers bypassing __proto__ filters via the constructor.prototype path, bracket notation, and JSON key variations, noting that Object.assign and shallow copies are safe and only deep or recursive merges are vulnerable.