Mini-game · Chapter 5

Prototype Pollution Lab

A simulated server's /api/update endpoint deep-merges your JSON into a config object. Walk three rounds with progressively stronger filters; the goal each time is to make every authenticated user think they are admin.

Educational training material. This game demonstrates an attack technique inside a sandboxed quiz UI for security learning. Do not apply these techniques against systems you do not own or have explicit written permission to test.

Round 1 / 3 Score 0 Tries 0 Time 00:00