Prototype Pollution

Recursos cross-platform para Prototype Pollution: máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

Esta página agrega los recursos para practicar Prototype Pollution de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

Cobertura: 11 retos en 3 plataformas — 1 HackTheBox · 9 PortSwigger · 1 TryHackMe. 1 con writeup en español, 1 con writeup en vídeo.

​

Por dónde empezar

Ordenado por dificultad real. A igual nivel, primero el lab aislado, después la room guiada y por último la máquina completa.

1. PortSwigger — Exfiltrating sensitive data via server-side prototype pollution (Apprentice) · 🇬🇧
2. TryHackMe — Custom Tooling Using Python (Easy · ~60 min) · 🇬🇧
3. PortSwigger — Bypassing flawed input filters for server-side prototype pollution (Practitioner) · 🇬🇧
4. PortSwigger — Client-side prototype pollution in third-party libraries (Practitioner) · 🇬🇧
5. PortSwigger — Client-side prototype pollution via flawed sanitization (Practitioner) · 🇬🇧
6. PortSwigger — Detecting server-side prototype pollution without polluted property reflection (Practitioner) · 🇬🇧

​

Recursos curados

Fuente	Enlace
PortSwigger	https://portswigger.net/web-security/prototype-pollution

​

Máquinas HTB que practican Prototype Pollution (1)

Máquina	SO	Dificultad	Writeup
Unobtainium	Linux	HARD	🇪🇸 🇬🇧 📹

​

Labs PortSwigger que practican Prototype Pollution (9)

Lab	Dificultad	Topic	Oficial
Exfiltrating sensitive data via server-side prototype pollution	APPRENTICE	Prototype Pollution	Abrir
Bypassing flawed input filters for server-side prototype pollution	PRACTITIONER	Prototype Pollution	Abrir
Client-side prototype pollution in third-party libraries	PRACTITIONER	Prototype Pollution	Abrir
Client-side prototype pollution via flawed sanitization	PRACTITIONER	Prototype Pollution	Abrir
Detecting server-side prototype pollution without polluted property reflection	PRACTITIONER	Prototype Pollution	Abrir
DOM XSS via an alternative prototype pollution vector	PRACTITIONER	Prototype Pollution	Abrir
DOM XSS via client-side prototype pollution	PRACTITIONER	Prototype Pollution	Abrir
Privilege escalation via server-side prototype pollution	PRACTITIONER	Prototype Pollution	Abrir
Remote code execution via server-side prototype pollution	PRACTITIONER	Prototype Pollution	Abrir

​

Rooms TryHackMe que practican Prototype Pollution (1)

Room	Dificultad	Tipo	Acceso	Oficial
Custom Tooling Using Python	EASY	Walkthrough	🟢 Free	Abrir

---

← Volver al glosario completo

Última actualización: 2026-08-13