Later archive addition

Probe the Proto: Measuring Client-Side Prototype Pollution Vulnerabilities of One Million Real-world Websites

Zifeng Kang, Song Li and Yinzhi Cao · NDSS Symposium

ProbeTheProto instruments a browser to follow joint taint flows, where a property lookup and an assignment meet on a prototype object, then generates inputs that drive a polluted property into a sink. A scan of one million sites found 2,738 vulnerable, with pollution reaching XSS, cookie manipulation and URL manipulation.

Record

Researcher

Zifeng Kang, Song Li and Yinzhi Cao

Published by

NDSS Symposium

In the archive

• Added to the 2022 archive after the original list was published

Related sources

• Talk recording
• Talk recording

Tags

• prototype-pollution
• xss
• large-scale-scan
• measurement-study
• dynamic-analysis
• javascript
• dom
• cookie
• tooling
• owasp-a03-2021
• owasp-a07-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Zifeng Kang, Song Li and Yinzhi Cao, first published at the original source. Preserved copies are kept so the citation survives its host.