Shazzer logo

    Bypass __proto__ string match defense

    Some applications protect against prototype pollution by matching the string "__proto__". We can bypass that.

    Created by: vitorfhc

    Created on: Thursday, August 29, 2024 at 1:03:13 AM

    Updated on: Friday, September 6, 2024 at 8:10:13 AM

    Vector type: JS

    Template used:
    s = "$[i]";
if (typeof s["$[chr]__proto__"] != "undefined") {
    log(fromCodePoint($[i]));
}
    Your browser was detected as:
    Detecting... Detecting... Detecting... Detecting...

    Sample payloads

    s = "0";
if (typeof s["__proto__"] != "undefined") {
    alert(String.fromCodePoint(0));
}

    Fuzz results

    Chrome logo
    Chrome 128.0.0.0 desktop macOS 10.15.7
    Found 1 result
    Data
    \