Nullcon Berlin 2023 | Server Side Prototype Pollution: Blackbox Detection Without The DoS by Gareth

This talk explores the challenges of detecting server-side prototype pollution (SSPP) without risking denial-of-service (DoS) issues. The speaker presents multiple techniques for identifying SSPP that do not require access to the server's source code, discussing the advantages and disadvantages of each method. Additionally, the session covers how to identify the JavaScript engine used on various sites through specially crafted requests. The speaker introduces an open-source Burp extension that facilitates SSPP detection within Burp Suite and concludes with defensive measures and a Q&A session.