Content released at NorthSec 2018 for my talk on prototype pollution
Switch branches/tags
Nothing to show
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
find-vuln Added the missing fuzzer described in the paper. Oct 31, 2018
paper Full content. May 16, 2018
payload Full content. May 16, 2018
slides Fixed typo Jun 9, 2018
videos Full content. May 16, 2018 Fixed README May 16, 2018

Prototype pollution attack


Prototype pollution is a term that was coined many years ago in the JavaScript community to designate libraries that added extension methods to the prototype of base objects like "Object", "String" or "Function". This was very rapidly considered a bad practice as it introduced unexpected behavior in applications. In this presentation, we will analyze the problem of prototype pollution from a different angle. What if an attacker could pollute the prototype of the base object with his own value? What APIs allow such pollution? What can be done with it?


Link to paper


Link to slides