Prototype Pollution

Cross-platform resources for Prototype Pollution: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice Prototype Pollution: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 11 challenges across 3 platforms — 1 HackTheBox · 9 PortSwigger · 1 TryHackMe. 1 with a Spanish writeup, 1 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Exfiltrating sensitive data via server-side prototype pollution (Apprentice) · 🇬🇧
2. TryHackMe — Custom Tooling Using Python (Easy · ~60 min) · 🇬🇧
3. PortSwigger — Bypassing flawed input filters for server-side prototype pollution (Practitioner) · 🇬🇧
4. PortSwigger — Client-side prototype pollution in third-party libraries (Practitioner) · 🇬🇧
5. PortSwigger — Client-side prototype pollution via flawed sanitization (Practitioner) · 🇬🇧
6. PortSwigger — Detecting server-side prototype pollution without polluted property reflection (Practitioner) · 🇬🇧

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/prototype-pollution

HTB machines practicing Prototype Pollution (1)

Machine	OS	Difficulty	Writeup
Unobtainium	Linux	HARD	🇪🇸 🇬🇧 📹

PortSwigger labs practicing Prototype Pollution (9)

Lab	Difficulty	Topic	Official
Exfiltrating sensitive data via server-side prototype pollution	APPRENTICE	Prototype Pollution	Open
Bypassing flawed input filters for server-side prototype pollution	PRACTITIONER	Prototype Pollution	Open
Client-side prototype pollution in third-party libraries	PRACTITIONER	Prototype Pollution	Open
Client-side prototype pollution via flawed sanitization	PRACTITIONER	Prototype Pollution	Open
Detecting server-side prototype pollution without polluted property reflection	PRACTITIONER	Prototype Pollution	Open
DOM XSS via an alternative prototype pollution vector	PRACTITIONER	Prototype Pollution	Open
DOM XSS via client-side prototype pollution	PRACTITIONER	Prototype Pollution	Open
Privilege escalation via server-side prototype pollution	PRACTITIONER	Prototype Pollution	Open
Remote code execution via server-side prototype pollution	PRACTITIONER	Prototype Pollution	Open

TryHackMe rooms practicing Prototype Pollution (1)

Room	Difficulty	Type	Access	Official
Custom Tooling Using Python	EASY	Walkthrough	🟢 Free	Open

---

← Back to the full glossary

Last updated: 2026-08-13