Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Prototype pollution : how to find gadgets when DOM invader can't find the source itself ?

sssss | Last updated: Jun 14, 2024 12:41PM UTC

Correct me if I'm wrong, but I think that DOM invader can't find a source as soon as the web application sanitizes the user-controllable properties by stripping any __proto__ from the key used to make a new property. If so, it may be easy to find the source manually (for example by entering /?__pro__proto__to__[foo]=bar when the WebApp does not recursively sanitize). Still, finding the gadgets may be tedious after that. Is there a way to indicate this source to DOM invader so that it is able to find the gadgets itself ?

Josh, PortSwigger Agent | Last updated: Jun 17, 2024 09:56AM UTC

Hi, we'll check up on this and get back to you soon. Thanks for your patience!

Hannah, PortSwigger Agent | Last updated: Jun 18, 2024 02:54PM UTC

Hi DOM Invader uses a preset list of 4 different techniques. These can be configured by enabling prototype pollution, clicking the cog button, and then going to the "Techniques" section. This list of techniques is currently not customizable. However, we do have an open feature request for users to be able to provide their own techniques. Would you like us to add your +1 to this feature request?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.