91 lines
1.8 KiB
YAML
91 lines
1.8 KiB
YAML
id: prototype-pollution-check
|
|
|
|
info:
|
|
name: Prototype Pollution Check
|
|
author: pdteam
|
|
severity: medium
|
|
tags: headless
|
|
|
|
headless:
|
|
- steps:
|
|
- args:
|
|
url: "{{BaseURL}}?constructor[prototype][vulnerableprop]=polluted#constructor[prototype][vulnerableprop]=polluted"
|
|
action: navigate
|
|
|
|
- action: waitload
|
|
|
|
- action: script
|
|
name: extract
|
|
args:
|
|
code: |
|
|
() => {
|
|
return window.vulnerableprop
|
|
}
|
|
|
|
matchers:
|
|
- type: word
|
|
part: extract
|
|
words:
|
|
- "polluted"
|
|
- steps:
|
|
- args:
|
|
url: "{{BaseURL}}?constructor.prototype.vulnerableprop=polluted#constructor.prototype.vulnerableprop=polluted"
|
|
action: navigate
|
|
|
|
- action: waitload
|
|
|
|
- action: script
|
|
name: extract2
|
|
args:
|
|
code: |
|
|
() => {
|
|
return window.vulnerableprop
|
|
}
|
|
|
|
matchers:
|
|
- type: word
|
|
part: extract2
|
|
words:
|
|
- "polluted"
|
|
|
|
- steps:
|
|
- args:
|
|
url: "{{BaseURL}}?__proto__[vulnerableprop]=polluted#__proto__.vulnerableprop=polluted&__proto__[vulnerableprop]=polluted"
|
|
action: navigate
|
|
|
|
- action: waitload
|
|
|
|
- action: script
|
|
name: extract3
|
|
args:
|
|
code: |
|
|
() => {
|
|
return window.vulnerableprop
|
|
}
|
|
|
|
matchers:
|
|
- type: word
|
|
part: extract3
|
|
words:
|
|
- "polluted"
|
|
- steps:
|
|
- args:
|
|
url: "{{BaseURL}}?__proto__.vulnerableprop=polluted"
|
|
action: navigate
|
|
|
|
- action: waitload
|
|
|
|
- action: script
|
|
name: extract4
|
|
args:
|
|
code: |
|
|
() => {
|
|
return window.vulnerableprop
|
|
}
|
|
|
|
matchers:
|
|
- type: word
|
|
part: extract4
|
|
words:
|
|
- "polluted"
|