Summary
Once you've confirmed prototype pollution exists, this is what you load to turn it into code execution. Covers the full escalation path: server-side RCE through template engine gadgets (EJS, Pug, Handlebars) and child_process pollution, client-side script gadgets in jQuery and Lodash, and practical bypass techniques when __proto__ is filtered. The gadget reference table alone is worth it. Includes black-box detection methods that work without source access and covers the constructor.prototype alternative when filters block the obvious path. This assumes you already understand merge sinks and basic pollution mechanics from the companion prototype-pollution skill.
Install to Claude Code
npx -y skills add yaklang/hack-skills --skill prototype-pollution-advanced --agent claude-codeInstalls into .claude/skills of the current project.
Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →
Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →Files
SKILL.md
Select a file.
Featured
Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →
