client-side prototype pullution vulnerability scanner

Last update: Dec 25, 2022

Related tags

Overview

JSPanda

JSpanda is client-side prototype pollution vulnerability scanner. It has two key features, scanning vulnerability the supplied URLs and analyzing the JavaScript libraries' source code.

However, JSpanda cannot detect advanced prototype pollution vulnerabilities.

How JSPanda works?

Uses multiple payloads for prototype pollution vulnerability.
Gathers all the links in the targets for scanning and add payloads to JSpanda-obtained URLs, navigates to each URL with headless Chromedriver.
Scans all words in the source code of potentially vulnerable JavaScript library and it creates a simple JS PoC by finding the script gadget, helping you analyze the code manually.

Requirements

Download latest version of Google Chrome and Chromedriver
Selenium

Usage

Scan: python3.7 jspanda.py

Add URLs to url.txt file, for instance : example.com

Basic Source Code Analysis : python3.7 analyze.py

Add a JavaScript library's source code to analyze.js
Generate PoC code using analyze.py
Execute PoC code on Chrome's console. It pollutes all the words collected from the source code and show it on the screen. So it may generate false positive results. These outputs provide additional information to researchers, do not automate everything.

Demonstration

Source code analysis - Screenshot

Supporting Materials :

https://twitter.com/har1sec/status/1314469278322655233

https://github.com/BlackFan/client-side-prototype-pollution

https://github.com/ThePacketBender/notes/blob/01c0b834f6e3ee4d934b087b2d92c9e484dc2a50/web/prototype_pollution.txt

https://habr.com/ru/company/huawei/blog/547178/

https://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2

https://github.com/securitum/research/tree/master/r2020_prototype-pollution

Learn Prototype Pollution in Series - Part 2

dwisiswant0/ppfuzz

GitHub - raverrr/plution: Prototype pollution scanner using headless chrome

JavaScript Prototype Poisoning Vulnerabilities in the Wild

The Complete Guide to Prototype Pollution Vulnerabilities

Comments

Traceback (most recent call last):

I am getting a error on running λ python jspanda.py Traceback (most recent call last): File "C:\Users\Yaseen\Downloads\cmder\jspanda\jspanda.py", line 24, in testsite_array = my_file.readlines() File "C:\Users\Yaseen\AppData\Local\Programs\Python\Python39\lib\encodings\cp1252.py", line 23, in decode return codecs.charmap_decode(input,self.errors,decoding_table)[0] UnicodeDecodeError: 'charmap' codec can't decode byte 0x81 in position 484: character maps to

opened by hellofresh01 1

This Plugin is For Logseq. If you're using wide monitors, you can place journals, linked references, and journal queries side by side.

Logseq Column-Layout Plugin Journals, linked references, and journal queries can be placed side by side if the minimum screen width is "1850px" or mor

Dec 14, 2022

Prototype Pollution exploits collection

Prototype Pollution Exploits Intro This repository is a collection of exploits for Prototype Pollution vulnerability. If you're not familiar with the

Dec 10, 2022

Simple shopping cart prototype which shows how React components and Redux can be used to build a friendly user experience with instant visual updates and scalable code in e-commerce applications.

This simple shopping cart prototype shows how React components and Redux can be used to build a friendly user experience with instant visual updates a

Feb 8, 2022

Prototype of real-time comments and a proposal of how to make it "production-ready".

Real-time comments prototype Simple demonstration of real-time commenting. Installation After forking it, run npm install, then you need two environme

Jan 16, 2022

Blog-webapp - A simple webapp prototype that serves tech news, blogs, and anything else a developer might want to learn or get help with

Blog Web app A simple webapp prototype that serves tech news, blogs, and anythin

Nov 3, 2022

Been interested, studying, and developing blockchain security with a Zero Knowledge Proof (ZKP) and create a prototype on the current issue with Philippine's upcoming election. 📥

Implementation of Zero Knowledge Proofs in Cryptographic Voting 😎 Reference: Cryptographic Voting – A Gentle Introduction Overview 👨🏻‍💻 The main i

Apr 11, 2022

A prototype snap for injecting gas fee prices into a confirmation window that also serves as the basis for a 5-minute Snaps tutorial

@Montoya/gas-fee-snap A simple Snap example based on @MetaMask/template-snap. Read below for a tutorial! Prerequisites Before you begin, make sure you

Dec 8, 2022

Decentralized Twitter prototype built with Polygon, GraphQL, Next.js, Ceramic, Arweave, and Bundlr

Titter - Web3 Social chat beta as fuck 🛠 Built with Next.js, Arweave, Bundlr, Ceramic, GraphQL, & Polygon How it works This is a working prototype of

Perma is a prototype of permanent video storage and viewing using Next.js, Arweave, and Bundlr.

PERMA Perma is a prototype of permanent video storage and client-side rendering using Next.js, Arweave, and Bundlr. Technologies used: Arweave - File

Oct 22, 2022

client-side prototype pullution vulnerability scanner

Related tags

Overview

JSPanda

How JSPanda works?

Requirements

Usage

Demonstration

Source code analysis - Screenshot

You might also like...

This Plugin is For Logseq. If you're using wide monitors, you can place journals, linked references, and journal queries side by side.

Prototype Pollution exploits collection

Simple shopping cart prototype which shows how React components and Redux can be used to build a friendly user experience with instant visual updates and scalable code in e-commerce applications.

Prototype of real-time comments and a proposal of how to make it "production-ready".

Blog-webapp - A simple webapp prototype that serves tech news, blogs, and anything else a developer might want to learn or get help with

Been interested, studying, and developing blockchain security with a Zero Knowledge Proof (ZKP) and create a prototype on the current issue with Philippine's upcoming election. 📥

A prototype snap for injecting gas fee prices into a confirmation window that also serves as the basis for a 5-minute Snaps tutorial

Decentralized Twitter prototype built with Polygon, GraphQL, Next.js, Ceramic, Arweave, and Bundlr

Perma is a prototype of permanent video storage and viewing using Next.js, Arweave, and Bundlr.

Comments

Traceback (most recent call last):

Owner

Red Section

EasyPen is a GUI program which helps pentesters do target discovery, vulnerability scan and exploitation

Fast and minimal JS server-side writer and client-side manager.

Easy server-side and client-side validation for FormData, URLSearchParams and JSON data in your Fresh app 🍋

Yara Station- Managment portal for LoKi scanner

Port Scanner with Javascript (NodeJs)

A community-led token scanner for Replit utilizing its own APIs.

Runs sfdx-scanner on a pull request and generates in-line comments with the findings.

Make drag-and-drop easier using DropPoint. Drag content without having to open side-by-side windows

This is an application that entered the market with a mobile application in real life. We wrote the backend side with node.js and the mobile side with flutter.

This plugin allows side-by-side notetaking with videos. Annotate your notes with timestamps to directly control the video and remember where each note comes from.