skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-nodejs

Detect and exploit high-severity Node.js runtime vulnerabilities in backend frameworks.

1.1k|191|Updated Jun 24, 2026
Search Tags:#nodejs#express#pentesting#rce#prototype-pollution#ssti#vulnerability-hunting
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-nodejs-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-nodejs
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-nodejs
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-nodejs-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill fills the gap in generic web application penetration testing by providing targeted, field-validated techniques for identifying and exploiting high-severity vulnerabilities unique to Node.js runtime environments and popular associated backend frameworks.

Core Features & Use Cases

  • Prototype Pollution to RCE Chains: Detect and exploit prototype pollution via lodash/merge, Object.assign, or qs library to reach critical sinks like child_process or template engines for remote code execution.
  • Express Trust Proxy Abuse: Identify and leverage misconfigured trust proxy settings to bypass IP-based rate limits and authentication allowlists.
  • Node.js-Specific Injection Vectors: Test for server-side template injection in EJS/Pug/Handlebars, child_process command injection, and require() path traversal for arbitrary code execution.
  • Sensitive Data Exfiltration: Exploit /proc/self/environ access via local file inclusion to leak environment variables including cloud provider credentials.
  • Use Case: A penetration tester assessing a Node.js/Express backend can use this Skill to systematically test for critical RCE vectors that would be missed by generic web app scans, reducing assessment time and improving finding quality.

Quick Start

Use the hunt-nodejs skill to test a target Node.js/Express application for prototype pollution, server-side template injection, and command injection vulnerabilities to identify potential remote code execution paths.

Frequently Asked Questions about hunt-nodejs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit prototype pollution to achieve RCE in a Node.js application?▼

Prototype pollution to RCE chains involve injecting malicious properties via unsafe lodash or qs merge operations to manipulate critical execution sinks like child_process or template engines, ultimately achieving remote code execution in Node.js applications.

What is Express trust proxy abuse and how does it bypass IP authentication?▼

Express trust proxy abuse exploits misconfigured trust proxy settings to spoof IP addresses via headers like X-Forwarded-For. This allows penetration testers to bypass IP-based authentication allowlists and rate limits protecting the Node.js backend.

Can I test for server-side template injection in EJS and Pug using Node.js vulnerability hunting?▼

Yes, Node.js vulnerability hunting systematically tests for server-side template injection (SSTI) in template engines like EJS, Pug, and Handlebars. It identifies injection vectors that allow arbitrary code execution through malicious template payloads.

How do I exfiltrate sensitive environment variables from a running Node.js process?▼

To exfiltrate sensitive environment variables from a Node.js process, exploit local file inclusion to access /proc/self/environ. This technique leaks runtime environment variables, potentially exposing cloud provider credentials during security assessments.

Does this Node.js pentesting approach cover Fastify and NestJS frameworks?▼

Yes, this Node.js pentesting approach covers backend frameworks including Fastify and NestJS in addition to Express and Koa. It identifies high-severity vulnerabilities like command injection and OS command execution specific to these runtime environments.

Related Skills

Explore More Software Engineering Skills→
langbyyilangbyyi
96

graphql-and-hidden-parameters

Identify GraphQL API vulnerabilities including hidden parameters and authorization gaps.

Community
Advanced
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
ok-helloworldok-helloworld
241

injection-agent

Model input-to-sink paths and generate targeted payloads for injection vulnerabilities.

Community
Advanced
uphiagouphiago
1.1k

hunt-springboot

Detect Spring Boot-specific vulnerabilities including Actuator endpoints, SpEL injection, and Spring4Shell.

Community
Intermediate