Detect Node.js vulnerabilities and attempt RCE chains via child_process.exec.
npx skills add https://github.com/Skobyn/talon --skill hunt-nodejs-skobyn
Please help me install this Agent Skill. Skill: hunt-nodejs Source: https://github.com/Skobyn/talon/tree/main/skills/hunt-nodejs Command: npx skills add https://github.com/Skobyn/talon --skill hunt-nodejs-skobyn
Hunt Node.js vulnerabilities, identify RCE chains, and perform specific security assessments.
Use the hunt-nodejs skill to scan a target application for Node.js vulnerabilities and RCE chains.
High-intent search queries and answers about installing and using this skill.
To detect Node.js vulnerabilities, the skill analyzes server response headers and error messages to fingerprint the backend, then validates specific flaws like Prototype Pollution and Express trust proxy misconfiguration.
Testing for Prototype Pollution involves identifying and validating Node.js-specific vulnerabilities within the application, checking if attack vectors successfully manipulate object prototypes to alter application behavior.
Yes, you can execute RCE chains by attempting to run code through sinks like child_process.exec, leveraging identified vulnerabilities to achieve remote code execution on the Node.js target.
Express trust proxy misconfiguration creates security issues by allowing attackers to spoof IP addresses and bypass access controls, which this skill specifically identifies and validates during assessment.
To fingerprint a server and confirm Node.js, the skill performs environment and server header analysis, inspecting specific response headers and error message patterns to verify the backend technology.
EntroVyxFingerprint Microsoft SharePoint Server versions and detect authentication bypass vulnerabilities.
0x0pointerEscalate privileges, harvest credentials, and enumerate compromised Linux and Windows hosts.
EntroVyxIdentify package-namespace squatting and dependency-confusion vulnerabilities in public GitHub organizations.
uphiagoDetect Spring Boot-specific vulnerabilities including Actuator endpoints, SpEL injection, and Spring4Shell.
