LivingInSyn / proto-pollution

prototype-pollution

This is a repo with some basic code to illustrate prototype pollution. It's all written in node.js and the curl commands for proof of concept are at the bottom of each sample.

This comes with no warranty of correctness or coolness

Some resources:

The paper:

• https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf

The talk:

• https://www.youtube.com/watch?v=LUsiFV3dsK8

Some more client side examples:

• https://github.com/BlackFan/client-side-prototype-pollution