Prototype Pollution labs
Prototype Pollution
What is Prototype Pollution?
Prototype Pollution is a JavaScript vulnerability where the attacker injects properties into Object.prototype via keys like __proto__ or constructor.prototype. It contaminates every object in the runtime and, with the right gadget, escalates to client-side XSS or Node.js RCE.
Why practice Prototype Pollution?
It's a modern, poorly understood class that affects ultra-popular libraries (lodash, jQuery, query parsers). Chained with a gadget, it goes from 'weird property' to real XSS or RCE. Finding it requires reading JS and understanding the runtime, so there's less competition and $1,000-$20,000 bounties.
What will you learn with the Prototype Pollution labs?
You'll learn to detect merge/clone/extend functions that recursively copy user input, inject __proto__/constructor.prototype via JSON or query string, confirm the pollution, and hunt for exploitable gadgets on both the client (DOM sinks) and the server (child_process, template engines).
Types of Prototype Pollution we cover
- Client-side
Pollution in browser JS (query string, postMessage) that a gadget turns into DOM XSS.
- Server-side (Node.js)
Pollution in a Node API that, with a gadget (spawn, require, render), escalates to RCE.
- Via query string parser
Parsers like qs interpret a[__proto__][x]=y and pollute the prototype without you sending JSON.
How do you find and exploit Prototype Pollution?
A practical playbook — from recon to proof of concept.
- 1
Find the recursive merge
Hunt the JS for functions that deep-copy objects (merge, extend, clone, defaultsDeep) fed by user input.
merge(target, JSON.parse(req.body)) · lodash.merge, $.extend(true, ...) - 2
Inject __proto__
Send a payload with __proto__ or constructor.prototype to add a property to the global prototype.
{"__proto__":{"polluted":"yes"}} - 3
Confirm the pollution
Check that a freshly-created object inherits your property. On the client, from the console; on the server, via a response that reflects it.
({}).polluted → "yes" (the pollution worked) - 4
Inject via query string
If the backend uses qs/Express, pollute without JSON using bracket notation in the URL.
?__proto__[polluted]=yes · ?constructor[prototype][polluted]=yes - 5
Chain with a gadget
Look for a gadget that reads an inherited property: on the client it can trigger a DOM sink (XSS); in Node, spawn/render options for RCE.
Client: __proto__.src → XSS · Node: __proto__.shell + child_process → RCE
Learn the theory
Academy: Advanced Techniques
Loading labs...
View in full catalog →Frequently asked questions
What is Prototype Pollution?
It's a JavaScript vulnerability where properties are injected into Object.prototype via keys like __proto__ or constructor.prototype. Since every object inherits from the prototype, the pollution affects the whole runtime and can escalate to XSS or RCE with the right gadget.
How is Prototype Pollution exploited?
You send a __proto__ payload to a function that recursively merges/clones the input (lodash.merge, $.extend). After polluting the prototype, you look for a gadget that reads that inherited property: on the client it triggers a DOM sink (XSS), in Node spawn/render options (RCE).
How do you find Prototype Pollution in bug bounty?
Read the JavaScript for deep merges of user-controlled objects, and inject __proto__ via JSON or query string (?__proto__[x]=y). Confirm with ({}).x and then invest time in finding a gadget that turns the pollution into impact.
How do you prevent Prototype Pollution?
Reject __proto__/constructor/prototype keys when parsing, use Object.create(null) or Map for prototype-less data, freeze Object.prototype (Object.freeze), validate with strict schemas, and keep merge/clone libraries updated.
Why does Prototype Pollution usually need a gadget?
Because polluting the prototype on its own does nothing visible: it adds an inherited property. The impact comes when another piece of code reads that property unexpectedly (a 'gadget') and uses it in a dangerous sink, turning the pollution into XSS or RCE.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Prototype Pollution in real labs
Every Prototype Pollution lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime