nuclei-templates/headless/prototype-pollution-check.yaml

88 lines
2.0 KiB
YAML

id: prototype-pollution-check
info:
name: Prototype Pollution Check
author: pdteam
severity: medium
tags: headless
headless:
- steps:
- args:
url: "{{BaseURL}}?constructor[prototype][vulnerableprop]=polluted#constructor[prototype][vulnerableprop]=polluted"
action: navigate
- action: waitload
- action: script
name: extract
args:
code: |
() => {
return window.vulnerableprop
}
matchers:
- type: word
part: extract
words:
- "polluted"
- steps:
- args:
url: "{{BaseURL}}?constructor.prototype.vulnerableprop=polluted#constructor.prototype.vulnerableprop=polluted"
action: navigate
- action: waitload
- action: script
name: extract2
args:
code: |
() => {
return window.vulnerableprop
}
matchers:
- type: word
part: extract2
words:
- "polluted"
- steps:
- args:
url: "{{BaseURL}}?__proto__[vulnerableprop]=polluted#__proto__.vulnerableprop=polluted&__proto__[vulnerableprop]=polluted"
action: navigate
- action: waitload
- action: script
name: extract3
args:
code: |
() => {
return window.vulnerableprop
}
matchers:
- type: word
part: extract3
words:
- "polluted"
- steps:
- args:
url: "{{BaseURL}}?__proto__.vulnerableprop=polluted"
action: navigate
- action: waitload
- action: script
name: extract4
args:
code: |
() => {
return window.vulnerableprop
}
matchers:
- type: word
part: extract4
words:
- "polluted"
# digest: 4a0a004730450220656faedcca72b80b1fedb471f40b5f961c48f425ff85367123613007e7c1e92a022100dfb11f7b5f3e0c8b25b48808ab2410e43c3d99c56daa615aa928145ef4153457:922c64590222798bb761d5b6d8e72950