Server Side Prototype Pollution
summary
Claims a safe black‑box way to detect server‑side prototype pollution without causing denial‑of‑service by flipping subtle behaviors rather than crashing the process. Techniques include changes JSON padding to mark responses, modifies Express config (param limits, exposed headers, status codes, double question‑marks, allowed dots, UTF‑7 charset) and asynchronous detection via uses --inspect to trigger DNS callbacks through Burp Collaborator. Releases an open‑source scanner for Burp Suite that finds leaks (reflected JavaScript native code, engine fingerprinting) and recommends Set/Map or Object.create(null) as fixes.
AI-written summary · about
chapters (19)
- 0:00Intro
- 3:32Prototype chain
- 5:26Merge operation
- 5:58Recursive merge function
- 7:52Encoding property takes the server down
- 13:30Change the maximum allowed parameters
- 14:18Allow multiple question marks in param
- 15:12Convert a parameter into an object
- 16:05Change the charset of a JSON response
- 17:34Investigating the charset technique
- 19:36Change the padding of a JSON response
- 21:44Change the status code
- 27:39Generic prototype pollution detection in Blitz
- 28:24A generic prototype pollution technique
- 31:19Asynchronous payloads problem
- 33:05Leaking code
- 33:42Detecting JavaScript engines
- 36:31Open source tool
- 37:02Preventing prototype pollution
related talks
40mPrototype Pollution Leads to RCE: Gadgets Everywhere
01h 04mServer-Side Browsing Considered Harmful
28mOffensive and Defensive Strategies for Client-Side JS Security
23mBURPing for Developers
29mHack Me if You Can
23mJavaScript attack surface
34mReal World JavaScript Security
45mProtection and Verification of Security Design Flaws