91 lines
2.1 KiB
YAML
91 lines
2.1 KiB
YAML
id: prototype-pollution-check
|
|
|
|
info:
|
|
name: Prototype Pollution Check
|
|
author: pdteam
|
|
severity: medium
|
|
metadata:
|
|
max-request: 4
|
|
tags: headless
|
|
|
|
headless:
|
|
- steps:
|
|
- args:
|
|
url: "{{BaseURL}}?constructor[prototype][vulnerableprop]=polluted#constructor[prototype][vulnerableprop]=polluted"
|
|
action: navigate
|
|
|
|
- action: waitload
|
|
|
|
- action: script
|
|
name: extract
|
|
args:
|
|
code: |
|
|
() => {
|
|
return window.vulnerableprop
|
|
}
|
|
matchers:
|
|
- type: word
|
|
part: extract
|
|
words:
|
|
- "polluted"
|
|
|
|
- steps:
|
|
- args:
|
|
url: "{{BaseURL}}?constructor.prototype.vulnerableprop=polluted#constructor.prototype.vulnerableprop=polluted"
|
|
action: navigate
|
|
|
|
- action: waitload
|
|
|
|
- action: script
|
|
name: extract2
|
|
args:
|
|
code: |
|
|
() => {
|
|
return window.vulnerableprop
|
|
}
|
|
matchers:
|
|
- type: word
|
|
part: extract2
|
|
words:
|
|
- "polluted"
|
|
|
|
- steps:
|
|
- args:
|
|
url: "{{BaseURL}}?__proto__[vulnerableprop]=polluted#__proto__.vulnerableprop=polluted&__proto__[vulnerableprop]=polluted"
|
|
action: navigate
|
|
|
|
- action: waitload
|
|
|
|
- action: script
|
|
name: extract3
|
|
args:
|
|
code: |
|
|
() => {
|
|
return window.vulnerableprop
|
|
}
|
|
matchers:
|
|
- type: word
|
|
part: extract3
|
|
words:
|
|
- "polluted"
|
|
|
|
- steps:
|
|
- args:
|
|
url: "{{BaseURL}}?__proto__.vulnerableprop=polluted"
|
|
action: navigate
|
|
|
|
- action: waitload
|
|
|
|
- action: script
|
|
name: extract4
|
|
args:
|
|
code: |
|
|
() => {
|
|
return window.vulnerableprop
|
|
}
|
|
matchers:
|
|
- type: word
|
|
part: extract4
|
|
words:
|
|
- "polluted"
|
|
# digest: 490a0046304402203ff07b0c962c43a69dfc76af68fa56d67e2a9fd360759cc049f60b0881de88c402207dbfca6a94102f5a72926b28b0d10c3e80ad752625090dfb46f31c1774758f99:922c64590222798bb761d5b6d8e72950 |