Skip to main content

Yadhu's Blog

Tag: Prototype Pollution

Exploiting Client-side Prototype Pollution - arg.js

First of all, a big shoutout to the challenge author. All the challenges in this set are available here. ## Analysis Going through the challenge source, we can see that two JavaScript files are imported. 1 2 <script src="https://raw.githack.com/stretchr/arg.js/master/dist/arg-1.4.js"></script> <script src="js/main.js"></script> arg-1.4.js is a popular library for parsing URL parameters. And main.js has the following content. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 let data = { small: "Hi, there!