hunt-nextjs

Detect SSRF, auth bypass, and data leakage in Next.js applications.

Updated Jul 1, 2026

Search Tags:#Next.js #web security #vulnerability scanning #data leakage #SSRF #auth bypass

Ready to run

npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-nextjs-bpnrockstar

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-nextjs
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-nextjs
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-nextjs-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill is designed to identify and exploit vulnerabilities in Next.js applications, providing a focused approach to security auditing.

Core Features & Use Cases

Next.js Vulnerability Detection: Detects and reports specific vulnerabilities unique to Next.js frameworks.
Server Actions Abuse: Identifies Server Actions auth bypass vulnerabilities.
Middleware Auth Bypass: Detects authentication bypasses in Next.js middleware.
Image Optimization SSRF: Discovers SSRF vulnerabilities in Next.js image optimization.
Data Leakage: Identifies potential data leakage through SSRF and other channels.
Use Case: For security professionals auditing Next.js applications, this Skill can be used to quickly identify critical vulnerabilities like SSRF and data leaks.

Quick Start

Use the hunt-nextjs skill to scan a target Next.js application for common vulnerabilities.

Frequently Asked Questions about hunt-nextjs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find SSRF vulnerabilities in Next.js image optimization?▼

Detecting SSRF vulnerabilities in Next.js image optimization involves scanning target applications to identify and confirm exploitable endpoints. This Skill targets Next.js 13/14/15 frameworks to discover unpatched image optimization flaws and potential data leakage channels.

What is a Next.js middleware auth bypass and how does it work?▼

A Next.js middleware auth bypass occurs when routing configurations fail to properly enforce authentication checks. This Skill identifies these specific authentication bypass vulnerabilities in Next.js applications to confirm their presence and exploitability.

Can I detect Server Actions auth bypass vulnerabilities in Next.js 14?▼

Yes, you can detect Server Actions auth bypass vulnerabilities in Next.js 14. This Skill specifically identifies Server Actions abuse and authentication bypasses unique to React SSR frameworks like Next.js 13, 14, and 15.

What is the best way to audit a Next.js application for data leakage?▼

The best way to audit a Next.js application for data leakage is to scan for SSRF and other framework-specific vulnerabilities. This approach quickly identifies critical data leaks in Next.js 13/14/15 and React SSR applications for security professionals.

Does this vulnerability scanning approach work with React SSR frameworks other than Next.js?▼

This vulnerability scanning approach focuses primarily on Next.js 13, 14, and 15. While it utilizes techniques for React SSR frameworks, its specific vulnerability detection capabilities for Server Actions and middleware are tailored to Next.js.