Documentation
¶
Overview ¶
pphack - The Most Advanced Client-Side Prototype Pollution Scanner
This repository is under MIT License https://github.com/edoardottt/pphack/blob/main/LICENSE
Index ¶
- Constants
- Variables
- func GenCustomQueryPayload(testPayload string) string
- func GenQueryPayload() (string, string)
- func GetChromeBrowser(copts []func(*chromedp.ExecAllocator)) (context.CancelFunc, context.Context, context.CancelFunc)
- func GetChromeOptions(r *Runner) []func(*chromedp.ExecAllocator)
- func GetHeaders(r *Runner) (map[string]interface{}, error)
- func GetJavascript(r *Runner, testPayload string) string
- func GetTestPayload(r *Runner, length int) string
- func PrepareURL(inputURL, testPayload string) (string, error)
- func Scan(pctx context.Context, r *Runner, headers map[string]interface{}, ...) (output.ResultData, error)
- type Runner
Constants ¶
const (
DefaultFilePerm = 0644
)
Variables ¶
var (
ErrWrongHeaderFormat = errors.New("header with wrong format")
)
Functions ¶
func GenCustomQueryPayload ¶
GenCustomPayload returns a ready to use HTTP GET query with the payload supplied as input.
func GenQueryPayload ¶
GenQueryPayload returns a ready to use HTTP GET query with a random generated payload and the payload used in the query.
func GetChromeBrowser ¶
func GetChromeBrowser(copts []func(*chromedp.ExecAllocator)) (context.CancelFunc, context.Context, context.CancelFunc)
GetChromeBrowser takes as input the chrome options and returns the context with the associated cancel functions to use the headless chrome browser it creates. Returns ecancel (exec allocator cancel), pctx (parent browser context), and pcancel (parent context cancel). Callers must invoke pcancel before ecancel to ensure correct cleanup order. ecancel is also called internally on fatal browser startup failure to avoid leaking the exec allocator before the process exits.
func GetChromeOptions ¶
func GetChromeOptions(r *Runner) []func(*chromedp.ExecAllocator)
GetChromeOptions takes as input the runner settings and returns the chrome options used to configure the headless browser instance. It always disables certificate errors and sets a custom user agent. If a proxy is configured in the runner options, it is appended as well.
func GetHeaders ¶ added in v0.0.5
GetHeaders returns the headers map.
func GetJavascript ¶
GetJavascript returns the Javascript code must be run on the target to verify the vulnerability.
func GetTestPayload ¶
GetTestPayload returns the payload specified as input or a random payload with a specified length.
func PrepareURL ¶
PrepareURL takes as input a URL and a payload and returns the final URL to scan.
func Scan ¶
func Scan( pctx context.Context, r *Runner, headers map[string]interface{}, js, value, targetURL string, ) (output.ResultData, error)
Scan is the core function that performs the prototype pollution scan. It takes a parent browser context (pctx), runner config (r), optional HTTP headers, the JavaScript payload (js), the original input value and the fully constructed target URL.
Flow:
- Creates a timeout-scoped context and a dedicated Chrome tab context.
- Navigates to targetURL and evaluates the JS pollution payload.
- If exploit mode is enabled and the payload returned a non-empty result, it runs fingerprinting to identify the affected library/sink.
- Attempts exploitation using the fingerprint results.
- Populates and returns a ResultData struct with all findings and errors.
Source Files