Testing playbook · advanced
Prototype Pollution (client & server)
Inject properties into Object.prototype to change app behavior - client-side DOM XSS or server-side RCE via gadget chains.
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.
Every step requires authorization. Review side effects before running commands against a live system.
Test for the sink
Add __proto__[test]=polluted via query, JSON body, or merge functions. On the client, check window.Object.prototype.test in console; on server, look for behavior changes.
curl 'https://target.com/api?__proto__[test]=polluted'Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Client-side: find a gadget
Look for sinks that read a polluted property (e.g., library options) and flow to innerHTML/script. DOM Invader (Burp) automates gadget hunting.
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Server-side: escalate to RCE
In Node apps, pollute properties consumed by child_process, template engines, or spawn options to achieve command execution.
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes
Common guidance
- JSON bodies with a literal "__proto__" key often bypass naive query-string filters.
- Client gadgets are library-specific - jQuery, Lodash, and sanitizers each have known ones.
Related tools
Mapped workflow tools
Sources
References
Version history: normalized permanent page created 2026-08-20.