domains / families / security / hunt-nodejs

hunt-nodejs

authentic

Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval injection, template engine SSTI (EJS/Pug/Handlebars), path traversal in file servers, require() injection, environment variable exfil via /proc/self/environ. Use when target runs Node.js/Express/Fastify/NestJS/Koa.

When to use

• Prototype Pollution to RCE chains
• Express trust proxy misconfiguration
• child_process/eval injection
• template engine SSTI (EJS/Pug/Handlebars)
• path traversal in file servers
• require() injection
• environment variable exfil via /proc/self/environ

Skill page

Source