Ppmap is a simple scanner/exploitation tool written in GO which automatically exploits known and existing gadgets (checks for specific variables in the global context) to perform XSS via Prototype Pollution. NOTE: The program only exploits known gadgets, but does not cover code analysis or any advanced Prototype Pollution exploitation, which may include custom gadgets.
Requirements
Make sure to have Chromium/Chrome installed:
sudo sh -c ‘echo “deb http://dl.google.com/linux/chrome/deb/ stable main” >> /etc/apt/sources.list.d/google.list’
wget -q -O – https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo apt-key add –
sudo apt-get update
sudo apt-get install google-chrome-stable
Make sure to have chromedp installed:
go get -u github.com/chromedp/chromedp
Installation
chmod +x ppmap
git clone https://github.com/kleiton0x00/ppmap.git
cd ~/ppmap
go build ppmap.go
Using the program is very simple, you can either:
echo 'https://target.com/index.html' | ./ppmap
echo 'http://target.com/something/?page=home' | ./ppmap
For mass scanning:cat url.txt | ./ppmap
where url.txt contains all url(s) in column.
Demo
Feel free to test the tool on the following websites as a part of demonstration:
https://msrkp.github.io/pp/2.html
https://ctf.nikitastupin.com/pp/known.html
Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…
While file extensions in Linux are optional and often misleading, the file command helps decode what a…
The touch command is one of the quickest ways to create new empty files or update timestamps…
Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…
Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…
Creating directories is one of the earliest skills you'll use on a Linux system. The mkdir (make…