1
1
1
1Some applications protect against prototype pollution by matching the string "__proto__". We can bypass that.
s = "$[i]";
if (typeof s["$[chr]__proto__"] != "undefined") {
log(String.fromCodePoint($[i]));
}s = "0";
if (typeof s["0x00__proto__"] != "undefined") {
alert(String.fromCodePoint(0));
}