skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-nextjs

Detects Next.js vulnerabilities including Server Actions abuse, middleware bypass, SSRF, and cache poisoning.

Updated Sep 6, 2026
Search Tags:#penetration testing#next.js#server actions#ssrf#bug bounty#vulnerability hunting#middleware bypass
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-nextjs-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-nextjs
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-nextjs
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-nextjs-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security researchers and bug bounty hunters need a systematic methodology to test Next.js applications for framework-specific vulnerabilities that generic web scanners miss, such as Server Actions authorization flaws and middleware bypasses. ## Core Features & Use Cases - Framework-Specific Attack Phases: Eight structured phases covering fingerprinting, Server Actions abuse, middleware auth bypass (including CVE-2025-29927), Image Optimization SSRF, /_next/data/ IDOR, ISR cache poisoning, debug endpoint exposure, and environment variable leakage. - False-Positive Guards: Built-in validation rules prevent misreporting, such as distinguishing the image optimizer's normal 400 allowlist rejection from a real SSRF, and requiring out-of-band callbacks for confirmation. - Use Case: During a bug bounty engagement against a Next.js 14 target, follow the phases to extract the build ID, test Server Actions without a session, probe /_next/data/ endpoints for IDOR, and confirm SSRF via a unique Collaborator callback. ## Quick Start Ask the AI to hunt for Next.js vulnerabilities on an authorized target using the hunt-nextjs methodology, starting with fingerprinting and build ID extraction.

Frequently Asked Questions about hunt-nextjs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test Next.js Server Actions for authorization bypass?▼

Extract action IDs from the HTML source or JS bundles, then send a POST request with the Next-Action header directly to the page without a valid session cookie. If the action executes and returns data or mutates state, authorization is enforced only client-side.

How to confirm SSRF in the Next.js /_next/image endpoint?▼

Confirm SSRF only via an out-of-band DNS or HTTP callback to a unique Collaborator subdomain passed as the url parameter. A 200 status returns an optimized image, not the upstream body, and a 400 is the normal allowlist rejection, so status codes alone never confirm SSRF.

What is the x-middleware-subrequest header bypass in Next.js?▼

CVE-2025-29927 allows skipping Next.js middleware entirely by sending the x-middleware-subrequest header with repeated middleware values, bypassing auth on gated routes. It is fixed in versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Does the Next.js debug stack frame endpoint exist in production?▼

No, __nextjs_original-stack-frame and __nextjs_launch-editor are react-dev-overlay middleware mounted only under next dev. A 404 in production is normal; only a non-404 response indicates a misconfigured dev server exposed in production.

Why is a reflected marker not proof of ISR cache poisoning?▼

A reflected marker only shows your input appears in the response, not that it persists in the cache. You must re-fetch the clean URL from a fresh client, confirm the marker is served to a different client, and check x-nextjs-cache or age headers.

Related Skills

Explore More Software Engineering Skills→
Wyl-cmdWyl-cmd
6

cms-detection

Identify CMS platforms, frameworks, and server technology stacks on live hosts.

Community
Intermediate
marcboggsmarcboggs

report-writing

Writes impact-first bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi with CVSS scoring.

Community
Intermediate
a-jay85a-jay85

security-audit

Audit PHP code for SQL injection, XSS, CSRF, and authentication flaws.

Community
Intermediate
jayteealaojayteealao

framework-conventions-guide

Enforce native conventions for Django, Laravel, Next.js, and Rails codebases.

Community
Basic