Server-Side Prototype Pollution Scanner
Summary: PortSwigger released a Burp Suite extension, version 1.0.8, that identifies server-side prototype pollution vulnerabilities and requires Burp Suite v2021.9 or later. Users right-click a request, open the extensions menu, select server side prototype pollution, and choose a scan option; the extension applies multiple detection techniques described in a PortSwigger blog post and whitepaper, and was last updated 13 March 2023.
What's compelling: Server-side prototype pollution is a class of flaw that standard scanning can miss, and this detection capability sits in an extension written by a third party that PortSwigger explicitly makes no warranty about - so the quality of what it finds is on the team running it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026