hunt-nextjs

Detect server-side and SSR vulnerabilities in Next.js applications.

Updated Jun 24, 2026
One-click install
npx skills add https://github.com/Skobyn/talon --skill hunt-nextjs-skobyn
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: hunt-nextjs
Source: https://github.com/Skobyn/talon/tree/main/skills/hunt-nextjs
Command: npx skills add https://github.com/Skobyn/talon --skill hunt-nextjs-skobyn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Detect and analyze Next.js application vulnerabilities, reducing the risk of exploitation.

Core Features & Use Cases

  • Vulnerability Detection: Automatically scan Next.js apps for common vulnerabilities.
  • Next.js Support: Specific to Next.js frameworks, targeting server-side and SSR issues.
  • Attack Surface Signals: Identify signals that point towards potential vulnerabilities like SSRF, auth bypass, and data leaks.

Quick Start

Use the hunt-nextjs skill to run a full vulnerability assessment on a target application.

Frequently Asked Questions about hunt-nextjs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a Next.js application for server-side vulnerabilities?

To scan a Next.js application for server-side vulnerabilities, you run an automated vulnerability assessment that targets server-side rendering issues, detecting threats like SSRF, data leaks, and authorization bypass.

What common web vulnerabilities are specific to Next.js frameworks?

Common Next.js vulnerabilities include server-side request forgery (SSRF), data leaks, and authorization bypass, particularly within server-side rendering and API route handling contexts.

Can I use this for red teaming exercises and bug bounty programs?

Yes, this vulnerability detection approach operates within the context of bug bounty programs and red teaming exercises to identify attack surface signals and reduce exploitation risk.

Does automated vulnerability detection work with Next.js SSR issues?

Automated vulnerability detection specifically targets Next.js server-side rendering issues by leveraging various testing strategies to identify common web application threats and data exposure points.

What is the best way to detect SSRF in a Next.js app?

The best way to detect SSRF in a Next.js app is through automated scanning that identifies attack surface signals pointing toward potential server-side request forgery and data leak vulnerabilities.