+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: Prototype pollution is it actual bad coding or false positive results from my scanner (/showthread.php?tid=6296826)
Prototype pollution is it actual bad coding or false positive results from my scanner - konaboy808 - Apr 23, 2025
I was using a prototype scanner that I wrote some code for and I was scanning a site and this is what I found. Is this my scanner returning a bunch of bullshit or is this a site that is really that messed up and dont know what they are doing. Input would be appreciated and maybe some direction in tuning my scanner to not return false issues in the future. I ican send you my code for the scanner also. If you tweek the code for my scanner please provide the corrections it would be of great help. 👍💯👍
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"createSummaryTransaction",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"createTemplateSummaryTransaction",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"getEligibleSubsidiariesFor",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"getEvaluationOptions",{enumerable:!0,get:function()
⚠️ Line 411: [HIGH] object_mutation - Object.defineProperty(e,"generateAuthorizeCancelSuccessModal",{enumerable:!0,get:function()
⚠️ Line 411: [HIGH] object_mutation - Object.defineProperty(e,"generateAuthorizeFailureModal",{enumerable:!0,get:function()
⚠️ Line 411: [HIGH] object_mutation - Object.defineProperty(e,"isTransactionPutOnHold",{enumerable:!0,get:function()
⚠️ Line 1570: [HIGH] dangerous_operations - Object.freeze({toString:()
⚠️ Line 1570: [HIGH] dangerous_operations - Object.freeze({})
Line 2089: [CRITICAL] prototype_manipulation - Object.setPrototypeOf(i,n.prototype)
Line 2427: [CRITICAL] prototype_manipulation - .prototype.serialize=
Line 2807: [CRITICAL] prototype_manipulation - .prototype.isNamespace=
Line 396: [HIGH] object_mutation - Object.defineProperty(e,"ACCOUNT_MAP_QUERY_PARAMS",{enumerable:!0,get:function()
⚠️ Line 396: [HIGH] object_mutation - Object.defineProperty(e,"ACCOUNT_MAP_REFRESH_STATUS",{enumerable:!0,get:function()
⚠️ Line 396: [HIGH] object_mutation - Object.defineProperty(e,"ACCOUNT_QUERY_PARAMS",{enumerable:!0,get:function()
⚠️ Line 396: [HIGH] object_mutation - Object.defineProperty(e,"AccountMapExtendedSearch",{enumerable:!0,get:function()
⚠️ Line 396: [HIGH] object_mutation - Object.defineProperty(e,"accountIsEligible",{enumerable:!0,get:function()
⚠️ Line 396: [HIGH] object_mutation - Object.defineProperty(e,"postAccountsFetch",{enumerable:!0,get:function()
⚠️ Line 396: [HIGH] object_mutation - Object.defineProperty(e,"postSingleAccountFetch",{enumerable:!0,get:function()
⚠️ Line 396: [HIGH] object_mutation - Object.defineProperty(e,"stringToMatch",{enumerable:!0,get:function()
⚠️ Line 396: [HIGH] object_mutation - Object.defineProperty(e,"updateAccountBalanceAndStatus",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"ACCOUNT_INTERMEDIARY_PROPERTIES",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"ACCOUNT_RECEIVER_PROPERTIES",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"ACH_ACCOUNT_PROPERTIES",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"COMMON_ACCOUNT_PROPERTIES",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"PROPERTY_TYPES",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"RECIPIENT_ACCOUNT_PROPERTIES",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"RECIPIENT_DETAIL_PROPERTIES",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"RTP_ACCOUNT_PROPERTIES",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"WAGE_GARNISHMENT_ADDENDA_PROPERTIES",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"wageGarnishmentAccountProperties",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"hasActualChanges",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"hasAddedProperty",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"hasRemovedProperty",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"hasUpdatedProperty",{enumerable:!0,get:function()
⚠️ Line 403: [HIGH] object_mutation - Object.defineProperty(e,"fetchAndPopulateWageGarnishmentForm",{enumerable:!0,get:function()
⚠️ Line 405: [HIGH] object_mutation - Object.defineProperty(e,"generateAuthorizeFailureModal",{enumerable:!0,get:function()
⚠️ Line 405: [HIGH] object_mutation - Object.defineProperty(e,"generateAuthorizeSuccessModal",{enumerable:!0,get:function()
⚠️ Line 405: [HIGH] object_mutation - Object.defineProperty(e,"generateDraftSuccessModal",{enumerable:!0,get:function()
Line 406: [HIGH] object_mutation - Object.defineProperty(e,"fromAccountFilter",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"getAccountDisplayText",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"toAccountFilter",{enumerable:!0,get:function()
Line 406: [HIGH] object_mutation - Object.defineProperty(e,"PaymentOptionsMapping",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"getPaymentActions",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"BankPolicyTypes",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"addCompanySubsidiary",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"capabilityCheck",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"createAccountMap",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"createCompanySubsidiary",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"createPaymentSummaryTransaction",{enumerable:!0,get:function()
⚠️ Line 406: [HIGH] object_mutation - Object.defineProperty(e,"createSummaryTransaction",{enumerable:!0,get:function()
data:text/plain;base64,dmFyIHEgPSBNYXRoLmZsb29yKG5ldyBEYXRlKCkuZ2V0VGltZSgpLzMwMDAwMCk7dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7d2luZG93Ll9fQk9CTGl2ZUNoYXQgPSB7fTtzLnNyYz0iaHR0cHM6Ly9zZGstY2RuLm9ubGluZWFjY2VzczEuY29tL3Nkay1uZ2lueC1hd3NwcmQvc2RrY2RuLzQxOTQtMDEtcHJkLWRiby00MTk0LXRyYWJpYW4tYmVjdS1xc2RrL0JPQkxpdmVDaGF0L2Fzc2V0cy91dXhfcGF5bG9hZC5qcz8iK3E7cy5zZXRBdHRyaWJ1dGUoJ2FzeW5jJyx0cnVlKTtzLnNldEF0dHJpYnV0ZSgnY3Jvc3NvcmlnaW4nLCAnYW5vbnltb3VzJyk7ZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiYm9keSIpLmFwcGVuZENoaWxkKHMpOw==: No connection adapters were found for 'data:text/plain;base64,dmFyIHEgPSBNYXRoLmZsb29yKG5ldyBEYXRlKCkuZ2V0VGltZSgpLzMwMDAwMCk7dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7d2luZG93Ll9fQk9CTGl2ZUNoYXQgPSB7fTtzLnNyYz0iaHR0cHM6Ly9zZGstY2RuLm9ubGluZWFjY2VzczEuY29tL3Nkay1uZ2lueC1hd3NwcmQvc2RrY2RuLzQxOTQtMDEtcHJkLWRiby00MTk0LXRyYWJpYW4tYmVjdS1xc2RrL0JPQkxpdmVDaGF0L2Fzc2V0cy91dXhfcGF5bG9hZC5qcz8iK3E7cy5zZXRBdHRyaWJ1dGUoJ2FzeW5jJyx0cnVlKTtzLnNldEF0dHJpYnV0ZSgnY3Jvc3NvcmlnaW4nLCAnYW5vbnltb3VzJyk7ZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiYm9keSIpLmFwcGVuZENoaWxkKHMpOw=='
RE: Prototype pollution is it actual bad coding or false positive results from my scanner - PercevalFox - Apr 24, 2025
Hello =)
Normal :
The usage of Object.defineProperty() with getters is a normal usage of framework JS or packaged code. Not really dangerous if there is no network access, DOML or evel in the getters
Object.freeze() is save excpect if combineted with other malicious mutation
Potentially dangerous :
Object.setPrototypeOf() or .prototype.* = ... can lead to prototype pollution, that's hot if it's accessible via externals inputs
The base 64 script inject dynamicly JS frm an external domain (sdk-cdn.onlineaccess1.com) via document.createElement("script")
Classic from a live chat, but also used for phishing or XSS, if it's not a trust domain : RED FLAG
Other :
TOOOOOO MUCH object_mutation, you have to filter like :
Flag only if getters are non-trivials (access to DOM, do fetch/ajax, or even user eval()
Keep thoses prototype_manipulation flags in CRITICAL, this is a real risk
You can send me the code, i'll help you if you need to make you code with less false positives and more pertinent