skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-nextjs

Identify and validate Next.js and React SSR security vulnerabilities.

3|1|Updated Jul 2, 2026
Search Tags:#nextjs#web-security#pentest#ssrf#auth-bypass#recon
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-nextjs-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-nextjs
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-nextjs
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-nextjs-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of manually auditing modern React-based SSR frameworks, specifically identifying misconfigurations and logic flaws that lead to unauthorized data access or server-side execution.

Core Features & Use Cases

  • Attack Surface Mapping: Automatically detects Next.js build IDs, debug endpoints, and exposed source maps.
  • Vulnerability Testing: Provides structured workflows for testing Server Actions, Middleware auth bypasses, and Image Optimization SSRF.
  • Use Case: When auditing a target running Next.js 14, use this skill to verify if Server Actions are enforcing authentication on the server-side or if they are susceptible to unauthorized execution.

Quick Start

Use the hunt-nextjs skill to perform a full security audit on the target domain example.com.

Frequently Asked Questions about hunt-nextjs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test Next.js Server Actions for authentication bypass vulnerabilities?▼

To test Next.js Server Actions for authentication bypass, you need to verify if server-side execution enforces auth checks. This skill provides structured workflows to uncover unauthorized execution and data leakage in Server Actions.

What is the best way to detect SSRF in Next.js image optimization endpoints?▼

Detecting SSRF in Next.js image optimization involves systematically enumerating build artifacts and API routes. This skill targets image optimization endpoints specifically to validate server-side request forgery exploitability.

How do I map the attack surface of a target running Next.js 14?▼

Mapping the attack surface of a Next.js 14 target requires detecting build IDs, debug endpoints, and exposed source maps. This skill automates this enumeration to identify misconfigurations leading to unauthorized data access.

Can I audit Next.js middleware for authentication bypasses?▼

Yes, you can audit Next.js middleware for authentication bypasses. The skill provides structured testing workflows to uncover logic flaws in middleware that lead to unauthorized server-side execution or data access.

Does this skill work with Next.js 13 and 15 or only Next.js 14?▼

This skill targets web applications utilizing Next.js 13, 14, or 15. It systematically enumerates build artifacts, API routes, and image optimization endpoints across these versions to confirm exploitability.

Why does my Next.js security audit fail to identify data leakage in React SSR?▼

A Next.js security audit may miss data leakage in React SSR without systematic enumeration of build artifacts and exposed source maps. This skill identifies misconfigurations and logic flaws that lead to unauthorized data access.

Related Skills

Explore More Software Engineering Skills→
RooseveltAdvisorsRooseveltAdvisors
1

WebAssessment

Automate web application security assessments and generate prioritized penetration testing plans.

Community
Advanced
uphiagouphiago
1.1k

hunt-nextjs

Detect Next.js 13/15 vulnerabilities including Server Actions auth bypass and Image Optimization SSRF.

Community
Advanced
DW225DW225
1

rbac-security

Enforce role-based access control and authentication on server actions and real-time messages.

Community
Advanced
bpnrockstarbpnrockstar

hunt-nextjs

Detect SSRF, auth bypass, and data leakage in Next.js applications.

Community
Advanced