Topic · 1 article

prototype pollution

Object.prototype pollution: gadgets in lodash/jQuery leading to XSS or Node.js RCE.

Quick answer

What is prototype pollution?

Object.prototype pollution: gadgets in lodash/jQuery leading to XSS or Node.js RCE.

Articles

Beginner

Intermediate

Advanced

Advanced level

Free

Prototype Pollution — from malicious JSON to XSS, RCE and auth bypass

How an attacker pollutes Object.prototype and breaks the code's assumptions. Client-side and server-side vectors, gadgets in lodash/jQuery/Angular.

13 minprototype-pollutionjavascriptclient-side

Read article

Practice prototype pollution with real labs

Apply the techniques in safe environments based on real bug bounty reports.

See prototype pollution labs

All topics Academy

2,482

hunters training

labs from real hacks

1,630

completions

$14,790

paid out for these bugs

11 flags captured this week·Real hacks from HackerOne · YesWeHack · Bugcrowd·No commitment·Free Academy

Free · no account

The checklist I run on every new target

47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.

Unsubscribe in one click, from any email.

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.

Create free account See the labs

No card · free Academy · cancel anytime