+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Help on Prototype Pollution (/showthread.php?tid=6141281)
Help on Prototype Pollution - doomerAndy - Feb 22, 2021
Hi there. I'm trying to hack into a machine and I have found a way in, but I need a prototype pollution vulnerability to make it happen and there is no crappy merge in there :/
Is there any way I can pollute a new property into Object.prototype just by a new variable assignment? Somewhere like this:
let newVar = JSON.parse(getJSONResponse(url))
Where we can assume that getJSONResponse() will always return a JSON object and we have full control of the url. Recall that neither functions nor expressions are parsed into a new object by JSON.parse().
Thanks so much