hunt-nodejs

Name: hunt-nodejs
Availability: InStock
Author: entrovyx

Detect and exploit Node.js vulnerabilities like prototype pollution and SSTI.

3|1|Updated Jul 2, 2026

Search Tags:#security #nodejs #pentest #rce #prototype-pollution #ssti

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-nodejs-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-nodejs
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-nodejs
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-nodejs-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of manually identifying and chaining complex Node.js-specific vulnerabilities like prototype pollution and template injection, which often lead to critical remote code execution.

Core Features & Use Cases

Vulnerability Detection: Automatically fingerprints Node.js/Express environments and tests for prototype pollution, SSTI, and command injection.
Exploit Chaining: Provides structured paths to escalate primitives like prototype pollution into full RCE via dangerous sinks like child_process or template engines.
Use Case: When auditing a Node.js application, use this skill to verify if a prototype pollution vulnerability can be escalated to RCE by testing specific sinks like lodash or EJS.

Quick Start

Use the hunt-nodejs skill to fingerprint the target and test for prototype pollution and template injection vulnerabilities.

Frequently Asked Questions about hunt-nodejs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I escalate a Node.js prototype pollution vulnerability to remote code execution?▼

To escalate prototype pollution to RCE in Node.js, you need to test dangerous sinks like child_process or template engines such as EJS. This skill systematically tests these sinks to validate if a pollution primitive can successfully trigger command execution.

What is the best way to test for SSTI and command injection in Express and Fastify applications?▼

Testing for SSTI and command injection in Express and Fastify involves fingerprinting the environment and evaluating template engines and execution sinks. This skill automates that workflow to identify exploitable server-side template injection paths.

Can I automatically fingerprint a NestJS application to find exploitable security primitives?▼

You can fingerprint NestJS applications to locate exploitable security primitives by testing environment configurations and framework-specific sinks. This skill targets NestJS to verify if detected vulnerabilities translate into impact-driven RCE.

How does prototype pollution interact with lodash sinks to enable remote code execution?▼

Prototype pollution interacts with lodash sinks by allowing manipulation of object properties that lodash uses internally, potentially hijacking execution flows. This skill provides structured chaining paths to validate this interaction and achieve RCE.

Why do I need to systematically test environment configurations during a Node.js pentest?▼

Systematically testing environment configurations during a Node.js pentest is required to validate the true impact of identified vulnerabilities like SSTI. This skill automates this validation process to ensure primitives reliably escalate into remote code execution.