Detecting server-side prototype pollution without polluted property reflection - Lab#07
In this video I walk through the “Detecting server-side prototype pollution without polluted property reflection” lab from PortSwigger Web Security Academy.
This Node.js / Express app unsafely merges user-controlled input into server-side objects, which can lead to prototype pollution — but the app doesn’t reflect polluted properties back in responses. The lab teaches safe, non-destructive detection techniques you can use to confirm the vulnerability without progressing to exploitation.
What you’ll learn:
How server-side prototype pollution arises in Node.js / Express apps.
Non-destructive ways to confirm pollution (trigger noticeable, harmless behavioral changes).
How to craft tests that reveal pollution without altering data or causing harm.
Why safe detection matters for responsible testing and disclosure.
Lab goal:
Confirm prototype pollution by causing a visible but non-destructive change in server behavior (no exploitation required).
Ethical reminder:
This video is for education and defensive research only. Always test in authorized, legal environments (like the Web Security Academy).
If this helped, please like, comment, and subscribe for more hands-on web security labs!
#PrototypePollution #ServerSideSecurity #NodeJS #ExpressJS #WebSecurity #PortSwigger #WebSecurityAcademy #EthicalHacking #BugBounty #InfoSec #PenTesting #SecurityResearch #NonDestructiveTesting