“lodash”的搜索结果

Review API configuration and input handling for unauthorized field updates, prototype pollution that alters shared object defaults, and manipulation of backend URLs. The skill also covers exposed API specifications and access control weaknesses in OData queries.

中文简介正在准备中。当前显示英语简介。

• Checking whether profile updates accept privileged fields
• Verifying the effects of prototype pollution
• Inspecting backend URL construction

Assess Node.js applications for unsafe input handling and configuration weaknesses. The skill covers prototype pollution, where shared object properties are altered, plus template and command injection, proxy trust issues, and file exposure, with checks for observable impact.

中文简介正在准备中。当前显示英语简介。

• Investigate prototype pollution in Node.js APIs
• Check Express proxy trust and IP restrictions
• Review template rendering and command execution inputs

Modern native JavaScript (ES2022-ES2025) utility patterns that replace lodash

中文简介正在准备中。当前显示原文说明。

在授权渗透测试中挖掘 JavaScript 原型污染（prototype pollution，服务端 Node.js 与客户端）。当目标把用户可控的键名递归合并进对象（merge/extend/set/clone、JSON body、query 解析）时使用——典型场景：用 `__proto__`/`constructor.prototype` 注入属性，污染全局原型，进而 DoS、改逻辑、配合 gadget 提权到 XSS/RCE。适用目标类型 Web / REST API（Node.js） / 前端。触发场景包括用户说"测下原型污染""这个 merge 能不能 __proto__""污染原型打 RCE/XSS""lodash/jquery 有没有污染点"。输出：污染点 + 可用 gadget 判定 + 反射证据的 finding（含 killed 记录）。

中文简介正在准备中。当前显示原文说明。

JavaScript prototype pollution — Object.prototype'u kirleterek auth bypass, RCE, XSS gadget chains (server-side Node.js ve client-side)

中文简介正在准备中。当前显示原文说明。

Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval injection, template engine SSTI (EJS/Pug/Handlebars), path traversal in file servers, require() injection, environment variable exfil via /proc/self/environ. Use when target runs Node.js/Express/Fastify/NestJS/Koa.

中文简介正在准备中。当前显示原文说明。