kleiton0x00/ppmapA scanner/exploitation tool written in GO, which leverages client-side Prototype Pollution to XSS by exploiting known gadgets.
A simple scanner/exploitation tool written in GO which automatically exploits known and existing gadgets (checks for specific variables in the global context) to perform XSS via Prototype Pollution. NOTE: The program only exploits known gadgets, but does not cover code analysis or any advanced Prototype Pollution exploitation, which may include custom gadgets.
Make sure to have Chromium installed. No need to worry, setup.sh will automatically install that for you.
git clone https://github.com/kleiton0x00/ppmap.git
cd ppmap/ && bash setup.sh
That's it. Enjoy using ppmap!
chmod +x ppmapUsing the program is very simple, you can either:
scan a directory/file (or even just the website itself):
echo 'https://target.com' | ppmap
or endpoint:
echo 'http://target.com/something/?page=home' | ppmap
For mass scanning:
cat url.txt | ppmap where url.txt contains all url(s) in column.
Feel free to test the tool on the following websites as a part of demonstration and to also check if the software is working correctly:
https://msrkp.github.io/pp/2.html
https://ctf.nikitastupin.com/pp/known.html
https://grey-acoustics.surge.sh
Many thanks to @Tomnomnom for the inspiration: https://www.youtube.com/watch?v=Gv1nK6Wj8qM&t=1558s
The workflow of this program is hugely based on this article: https://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2
The fingerprint javascript file is based on this git: https://gist.github.com/nikitastupin/b3b64a9f8c0eb74ce37626860193eaec