What problem does it solve? Security testers assessing Node.js backends often lack a disciplined, evidence-driven process, leading to false positives from scanner hits, npm package guesses, or frontend JavaScript misread as server-side findings. This Skill enforces an authorization-first, single-variable probing methodology for Node.js, Express, Fastify, and NestJS targets so every reported issue is backed by server-side oracle evidence. ## Core Features & Use Cases - Framework Fingerprinting: Confirms runtime, framework, and version via response headers, error stacks, build artifacts, and deployment metadata before any testing. - Evidence-Gated Probing: Applies a strict baseline → single-variable probe → post-baseline → oracle → evidence loop for parser, path, and authorization differentials. - Routing & Escalation Discipline: Routes prototype pollution, command injection, SSTI, upload, and dependency findings to dedicated specialist Skills, and CVEs to the bb-methodology workflow. - Use Case: During an authorized engagement against an Express API, use this Skill to confirm the stack version, map JSON/query/body parsers and static paths, then run safe differential probes on your own objects while treating WAF blocks and scanner hits as inconclusive. ## Quick Start Use the hunt-nodejs skill to plan an evidence-gated, authorized validation path against my in-scope Node.js target.
