# Hunt Nextjs

Hunt Next.js specific vulnerabilities, Server Actions arbitrary function execution...

- Repository: https://github.com/elementalsouls/Claude-BugHunter (5368 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-nextjs -g -a claude-code -y`
Codex: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-nextjs -g -a codex -y`
Cursor: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-nextjs -g -a cursor -y`
Gemini CLI: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-nextjs -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elementalsouls/Claude-BugHunter`

## Description

Hunt Next.js specific vulnerabilities, Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF (/_next/image), RSC payload leakage, getServerSideProps injection, source map exposure, debug endpoint leakage. Use when target runs Next.js 13/14/15 or any React SSR framework.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# HUNT-NEXTJS, Next.js / SSR Framework Vulnerabilities

## Crown Jewel Targets

Next.js-specific bugs that bypass auth or reach SSRF = High/Critical.

**Highest-value chains:**
- **Server Actions auth bypass**, Server Actions enforce auth client-side only → call action ID directly → unauthorized data mutation or exfil
- **Middleware bypass via `/_next/static/`**, middleware skips static asset paths → protected routes accessible via `/_next/data/` IDOR
- **`/_next/image` SSRF**, Image optimizer fetches attacker-controlled URL → internal network scan or cloud metadata
- **ISR stale cache poisoning**, inject malicious content into a cached page that gets served to all users
- **RSC payload leakage**, React Server Component flight data contains server-side props not meant for client

---

## Attack Surface Signals

```
/_next/image?url=&w=&q=          Image optimizer, SSRF candidate
/_next/data/BUILD_ID/*.json      Prerendered page data, IDOR candidate
/__nextjs_original-stack-frame   Debug stack frame endpoint
/_next/static/chunks/            JS bundles, source map candidate
/api/                            API routes, standard hunt surface
__NEXT_DATA__ in HTML            SSR props leaked to client
x-nextjs-* response headers      Confirms Next.js
```

---

## Phase 1, Fingerprint & Version Detection

```bash
# Confirm Next.js and get build ID
curl -s https://$TARGET/ | grep -oP '"buildId":"[^"]+"'
curl -sI https://$TARGET/ | grep -i "x-powered-by\|x-nextjs"

# Extract build ID for /_next/data/ paths
BUILD_ID=$(curl -s https://$TARGET/ | grep -oP '"buildId":"\K[^"]+')
echo "Build ID: $BUILD_ID"

# Check Next.js version via package disclosure
curl -s https://$TARGET/_next/static/chunks/framework*.js | grep -oP '"next":"[^"]+"'

# Source map exposure
curl -s "https://$TARGET/_next/static/chunks/pages/index.js.map" | head -5
curl -s "https://$TARGET/_next/static/chunks/main.js.map" | head -5
```

---

## Phase 2, Server Actions Abuse

The rest: https://github.com/elementalsouls/Claude-BugHunter/blob/HEAD/skills/hunt-nextjs/SKILL.md