domains / families / security / hunt-nextjs

hunt-nextjs

combined

Hunt Next.js specific vulnerabilities Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF (/_next/image), RSC payload leakage, getServerSideProps injection, source map exposure, debug endpoint leakage. Use when target runs Next.js 13/14/15 or any React SSR framework.

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

The two copies share the same core Next.js hunt procedure (fingerprinting, Server Actions abuse, middleware bypass, /_next/image SSRF), but each contains material steps the other lacks. The uphiago copy includes a detailed false-positive guard for /_next/image SSRF and a note distinguishing CVE-2024-34351 from the image optimizer, plus explicit curl timeouts. The sickn33 copy adds a mandatory authorization confirmation gate and a specific middleware bypass via the x-middleware-subrequest header (CVE-2025-29927) with fixed versions. Crowning one would hide a real alternative procedure and a distinct vulnerability technique.