forked from projectdiscovery/nuclei-templates
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathprototype-pollution-check.yaml
91 lines (78 loc) · 2.05 KB
/
prototype-pollution-check.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
id: prototype-pollution-check
info:
name: Prototype Pollution Check
author: pdteam
severity: medium
metadata:
max-request: 4
tags: headless
headless:
- steps:
- args:
url: "{{BaseURL}}?constructor[prototype][vulnerableprop]=polluted#constructor[prototype][vulnerableprop]=polluted"
action: navigate
- action: waitload
- action: script
name: extract
args:
code: |
() => {
return window.vulnerableprop
}
matchers:
- type: word
part: extract
words:
- "polluted"
- steps:
- args:
url: "{{BaseURL}}?constructor.prototype.vulnerableprop=polluted#constructor.prototype.vulnerableprop=polluted"
action: navigate
- action: waitload
- action: script
name: extract2
args:
code: |
() => {
return window.vulnerableprop
}
matchers:
- type: word
part: extract2
words:
- "polluted"
- steps:
- args:
url: "{{BaseURL}}?__proto__[vulnerableprop]=polluted#__proto__.vulnerableprop=polluted&__proto__[vulnerableprop]=polluted"
action: navigate
- action: waitload
- action: script
name: extract3
args:
code: |
() => {
return window.vulnerableprop
}
matchers:
- type: word
part: extract3
words:
- "polluted"
- steps:
- args:
url: "{{BaseURL}}?__proto__.vulnerableprop=polluted"
action: navigate
- action: waitload
- action: script
name: extract4
args:
code: |
() => {
return window.vulnerableprop
}
matchers:
- type: word
part: extract4
words:
- "polluted"
# digest: 490a0046304402203ff07b0c962c43a69dfc76af68fa56d67e2a9fd360759cc049f60b0881de88c402207dbfca6a94102f5a72926b28b0d10c3e80ad752625090dfb46f31c1774758f99:922c64590222798bb761d5b6d8e72950