webmedium

AgriWeb

hackthebox

Task: Patch a prototype pollution vulnerability in a Node.js Express web app to get the flag. Solution: Identify unfiltered __proto__/constructor keys in a deepMerge function, upload a patched version that filters dangerous keys, restart the app, and verify the fix via /api/verify endpoint.

$ ls tags/ techniques/
nodejsjavascriptprototype_pollutionexpressapicode_patching
prototype_pollution_fixdeepmerge_sanitizationcode_review
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]