1
1
1
1Some applications protect against prototype pollution by matching the string "__proto__". We can bypass that.
s = "$[i]";
if (typeof s["$[chr]__proto__"] != "undefined") {
log(fromCodePoint($[i]));
}s = "0";
if (typeof s["0x00__proto__"] != "undefined") {
alert(fromCodePoint(0));
}