Prototype Pollution Advanced

Once you've confirmed prototype pollution exists, this is what you load to turn it into code execution. Covers the full escalation path: server-side RCE through template engine gadgets (EJS, Pug, Handlebars) and child_process pollution, client-side script gadgets in jQuery and Lodash, and practical bypass techniques when __proto__ is filtered. The gadget reference table alone is worth it. Includes black-box detection methods that work without source access and covers the constructor.prototype alternative when filters block the obvious path. This assumes you already understand merge sinks and basic pollution mechanics from the companion prototype-pollution skill.