Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics. Use when you've confirmed pollution and need to escalate to code execution or find framework-specific gadgets.

SKILL: Prototype Pollution Advanced — RCE & Gadget Exploitation AI LOAD INSTRUCTION : Advanced prototype pollution escalation. Covers server side RCE via template engines (EJS, Pug, Handlebars), Node.js child process gadgets, client side script gadgets, filter bypass patterns, and systematic detection. Load [../prototype pollution/SKILL.md](../prototype pollution/SKILL.md) first for fundamentals (merge sinks, proto vs constructor.prototype , basic probes). 0. RELATED ROUTING [prototype pollution](../prototype pollution/SKILL.md) — LOAD FIRST for PP fundamentals, merge sink detection, basic probes [ssti server side template injection](../ssti server side template injection/SKILL.md) — template engine RCE context (PP often triggers through template gadgets) [xss cross site scripting](../xss cross site scripting/SKILL.md) — client side PP gadgets ultimately achieve XSS Advanced Reference Load [KNOWN GADGETS.md](./KNOWN GADGETS.md) for the comprehensive gadget table by framework/library with polluted properties, trigger conditions, impact, and affected versions. 1. SERVER SIDE PP → RCE 1.1 Node.js child process.spawn — Shell/ENV Injection When child process.spawn or child process.fork is called without explicit env / shell options, it inherits from Object.prototype : Alternative ENV pollution: 1.2 EJS (Embedded JavaScript Templates) EJS render() reads opts from object properties. Polluting outputFunctionName injects code into the compiled template function: Detection: any EJS res.render() call after pollution triggers it. 1.3 Pug (formerly Jade) Pug's compiler reads block from object properties: Alternative via self option: 1.4 Handlebars Handlebars template compilation checks type and program on template AST nodes: Simpler via allowProtoMethodsByDefault : 1.5 Nunjucks 1.6 Express res.render (Generic) When Express calls res.render() , options merge with app.locals and res.locals . Polluted prototype properties appear as template variables: 2. CLIENT SIDE PROTOTYPE POLLUTION 2.1 jQuery Gadgets $.extend(true, {}, userInput) performs deep merge — classic PP sink. After pollution, jQuery's HTML methods use polluted properties: 2.2 Lodash Gadgets 2.3 Script Gadgets in Frameworks "Script gadgets" are framework code paths that read from Object.prototype and perform dangerous operations: Framework Gadget Pattern Polluted Property Impact jQuery $.html() , element creation innerHTML , src XSS Angular.js $interpolate defineGetter XSS Vue.js Template compilation template , render XSS Ember.js Component rendering Various view properties XSS Backbone.js .template sourceURL XSS 2.4 DOM Property Pollution 3. DETECTION TECHNIQUES 3.1 Black Box Server Side Detection 3.2 Black Box Client Side Detection 3.3 Automated Tools Tool Type Purpose PPScan Burp Extension Scans for server side PP server side prototype pollution Burp Extension (Gareth Heyes) Advanced server side PP detection with multiple techniques ppfuzz CLI Fuzz for client side PP via URL fragment/query ppmap CLI Map client side PP to known gadgets 4. BYPASS proto FILTERS 4.1 constructor.prototype Path 4.2 Bracket Notation Variants 4.3 JSON Key Variations 4.4 Key Distinction: Shallow vs Deep Object.assign does NOT pollute prototype (shallow copy, safe). Only recursive/deep merge functions are vulnerable. Always verify the merge depth. 5. EXPLOITATION FLOW 6. DECISION TREE 7. QUICK REFERENCE — KEY PAYLOADS

prototype-pollution-advanced