98 lines
3.2 KiB
YAML
98 lines
3.2 KiB
YAML
id: prototype-pollution-check
|
|
|
|
info:
|
|
name: Prototype Pollution Check
|
|
author: pdteam
|
|
severity: medium
|
|
reference:
|
|
- https://github.com/msrkp/PPScan
|
|
tags: headless
|
|
|
|
headless:
|
|
- steps:
|
|
- action: setheader
|
|
args:
|
|
part: response
|
|
key: Content-Security-Policy
|
|
value: "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;"
|
|
- action: setheader
|
|
args:
|
|
part: response
|
|
key: X-Frame-Options
|
|
value: foo
|
|
- action: setheader
|
|
args:
|
|
part: response
|
|
key: If-None-Match
|
|
value: foo
|
|
- action: script
|
|
args:
|
|
hook: true
|
|
code: |
|
|
// Hooking code adapted from https://github.com/msrkp/PPScan/blob/main/scripts/content_script.js
|
|
() => {
|
|
window.alerts = [];
|
|
|
|
logger = found => window.alerts.push(found);
|
|
|
|
function check() {
|
|
loc = location.href;
|
|
|
|
if (loc.indexOf("e32a5ec9c99") >= 0 && loc.search("a0def12bce") == -1) {
|
|
setTimeout(function() {
|
|
if (Object.prototype.e32a5ec9c99 == "ddcb362f1d60") {
|
|
logger(location.href);
|
|
}
|
|
var url = new URL(location.origin + location.pathname);
|
|
url.hash = "__proto__[a0def12bce]=ddcb362f1d60&__proto__.a0def12bce=ddcb362f1d60&dummy";
|
|
location = url.href;
|
|
}, 5 * 1000);
|
|
} else if (loc.search("a0def12bce") != -1) {
|
|
setTimeout(function() {
|
|
if (Object.prototype.a0def12bce == "ddcb362f1d60") {
|
|
logger(location.href);
|
|
}
|
|
window.close();
|
|
}, 5 * 1000);
|
|
} else {
|
|
var url = new URL(loc);
|
|
url.searchParams.append("__proto__[e32a5ec9c99]", "ddcb362f1d60");
|
|
url.searchParams.append("__proto__.e32a5ec9c99", "ddcb362f1d60");
|
|
location = url.href;
|
|
}
|
|
}
|
|
|
|
window.onload = function() {
|
|
if (Object.prototype.e32a5ec9c99 == "ddcb362f1d60" || Object.prototype.a0def12bce == "ddcb362f1d60") {
|
|
logger(location.href);
|
|
} else {
|
|
check();
|
|
}
|
|
};
|
|
|
|
var timerID = setInterval(function() {
|
|
if (Object.prototype.e32a5ec9c99 == "ddcb362f1d60" || Object.prototype.a0def12bce == "ddcb362f1d60") {
|
|
logger(location.href);
|
|
clearInterval(timerID);
|
|
}
|
|
}, 5 * 1000);
|
|
}
|
|
- args:
|
|
url: "{{BaseURL}}"
|
|
action: navigate
|
|
- action: waitload
|
|
- action: script
|
|
name: alerts
|
|
args:
|
|
code: window.alerts
|
|
matchers:
|
|
- type: word
|
|
part: alerts
|
|
words:
|
|
- "__proto__"
|
|
extractors:
|
|
- type: kval
|
|
part: alerts
|
|
kval:
|
|
- alerts
|