hunt-nextjs

What problem does it solve?

This Skill solves the problem of identifying hard-to-detect, framework-specific vulnerabilities in Next.js 13/15 and React SSR applications that generic web scanners miss, reducing the risk of missing critical flaws like auth bypasses, SSRF, and data leakage during authorized security assessments.

Core Features & Use Cases

• Next.js-Specific Vulnerability Detection: Identifies high-impact flaws including Server Actions auth bypass, Middleware bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF, RSC payload leakage, and debug endpoint exposure.
• Targeted Attack Surface Mapping: Pinpoints Next.js-specific endpoints (/_next/image, /_next/data/, NEXT_DATA) and version-specific weaknesses using disclosed CVEs (e.g., CVE-2024-34351) and official framework advisories.
• Use Case: Use during authorized penetration tests or red team engagements of Next.js applications to uncover critical vulnerabilities that can lead to admin access, cloud compromise, or sensitive user data exfiltration.

Quick Start

Use the hunt-nextjs skill to scan a target Next.js application for Server Actions auth bypass, Image SSRF, and Middleware bypass vulnerabilities, then validate findings with out-of-band callbacks to confirm exploitability.