> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# Prototype Pollution

> Recursos cross-platform para Prototype Pollution: máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

# Prototype Pollution

Esta página agrega los **recursos para practicar Prototype Pollution** de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

## Recursos curados

| Fuente      | Enlace                                                                                                               |
| ----------- | -------------------------------------------------------------------------------------------------------------------- |
| PortSwigger | [https://portswigger.net/web-security/prototype-pollution](https://portswigger.net/web-security/prototype-pollution) |

## Máquinas HTB que practican Prototype Pollution (1)

| Máquina                                                | SO    | Dificultad                                       |
| ------------------------------------------------------ | ----- | ------------------------------------------------ |
| [Unobtainium](/htb/machines/linux/dificil/unobtainium) | Linux | <span className="dbadge dbadge-hard">HARD</span> |

## Labs PortSwigger que practican Prototype Pollution (9)

| Lab                                                                                                                                                                                                                | Dificultad                                                 | Topic               | Oficial                                                                                                                                                          |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------- | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Exfiltrating sensitive data via server-side prototype pollution](/portswigger/labs/prototype-pollution/server-side-exfiltrating-sensitive-data-via-server-side-prototype-pollution)                               | <span className="dbadge dbadge-easy">APPRENTICE</span>     | Prototype Pollution | [Abrir](https://portswigger.net/web-security/prototype-pollution/server-side/lab-exfiltrating-sensitive-data-via-server-side-prototype-pollution)                |
| [Bypassing flawed input filters for server-side prototype pollution](/portswigger/labs/prototype-pollution/server-side-bypassing-flawed-input-filters-for-server-side-prototype-pollution)                         | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Prototype Pollution | [Abrir](https://portswigger.net/web-security/prototype-pollution/server-side/lab-bypassing-flawed-input-filters-for-server-side-prototype-pollution)             |
| [Client-side prototype pollution in third-party libraries](/portswigger/labs/prototype-pollution/client-side-prototype-pollution-client-side-prototype-pollution-in-third-party-libraries)                         | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Prototype Pollution | [Abrir](https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-client-side-prototype-pollution-in-third-party-libraries)   |
| [Client-side prototype pollution via flawed sanitization](/portswigger/labs/prototype-pollution/client-side-prototype-pollution-client-side-prototype-pollution-via-flawed-sanitization)                           | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Prototype Pollution | [Abrir](https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-client-side-prototype-pollution-via-flawed-sanitization)    |
| [Detecting server-side prototype pollution without polluted property reflection](/portswigger/labs/prototype-pollution/server-side-detecting-server-side-prototype-pollution-without-polluted-property-reflection) | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Prototype Pollution | [Abrir](https://portswigger.net/web-security/prototype-pollution/server-side/lab-detecting-server-side-prototype-pollution-without-polluted-property-reflection) |
| [DOM XSS via an alternative prototype pollution vector](/portswigger/labs/prototype-pollution/client-side-prototype-pollution-dom-xss-via-an-alternative-prototype-pollution-vector)                               | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Prototype Pollution | [Abrir](https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-dom-xss-via-an-alternative-prototype-pollution-vector)      |
| [DOM XSS via client-side prototype pollution](/portswigger/labs/prototype-pollution/client-side-prototype-pollution-dom-xss-via-client-side-prototype-pollution)                                                   | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Prototype Pollution | [Abrir](https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-dom-xss-via-client-side-prototype-pollution)                |
| [Privilege escalation via server-side prototype pollution](/portswigger/labs/prototype-pollution/server-side-privilege-escalation-via-server-side-prototype-pollution)                                             | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Prototype Pollution | [Abrir](https://portswigger.net/web-security/prototype-pollution/server-side/lab-privilege-escalation-via-server-side-prototype-pollution)                       |
| [Remote code execution via server-side prototype pollution](/portswigger/labs/prototype-pollution/server-side-remote-code-execution-via-server-side-prototype-pollution)                                           | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Prototype Pollution | [Abrir](https://portswigger.net/web-security/prototype-pollution/server-side/lab-remote-code-execution-via-server-side-prototype-pollution)                      |

## Rooms TryHackMe que practican Prototype Pollution (1)

| Room                                                                | Dificultad                                       | Tipo        | Acceso  | Oficial                                                 |
| ------------------------------------------------------------------- | ------------------------------------------------ | ----------- | ------- | ------------------------------------------------------- |
| [Custom Tooling Using Python](/tryhackme/rooms/customtoolingpython) | <span className="dbadge dbadge-easy">EASY</span> | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/customtoolingpython) |

***

← [Volver al glosario completo](/glosario)

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"DefinedTerm","name":"Prototype Pollution","termCode":"prototype-pollution","inLanguage":"es","url":"https://rootea.es/skills/prototype-pollution","inDefinedTermSet":{"@type":"DefinedTermSet","name":"Glosario táctico de pentesting","url":"https://rootea.es/glosario"}}`}
</script>

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"ItemList","name":"Máquinas HTB que practican Prototype Pollution","numberOfItems":1,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://rootea.es/htb/machines/linux/dificil/unobtainium","name":"Unobtainium"}]}`}
</script>

*Última actualización: 2026-06-07*