Prototype pollution settings - Port Swigger
Summary: PortSwigger's DOM Invader tool includes a Prototype pollution settings panel that lets testers fine-tune how it scans for prototype pollution gadgets, including options for automatic gadget scanning on page load, a slider for properties tested per frame, and recursive scanning of nested properties. The settings also control which injection vectors are tested (query string, URL hash, JSON-based web messages), whether the CSP and X-Frame-Options headers are stripped from responses, and whether each technique runs in a separate iframe.
Key Takeaway: The documentation states that DOM Invader's default automatic scaling of properties per frame can cause gadgets to be missed, for example when an injected property throws an exception that prevents testing of other gadgets in the same iframe, producing false negatives.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026