hunt-nextjs

# HUNT-NEXTJS — Next.js / SSR Framework Vulnerabilities ## Crown Jewel Targets Next.js-specific bugs that bypass auth or reach SSRF = High/Critical. **Highest-value chains:** - **Server Actions auth bypass** — Server Actions enforce auth client-side only → call action ID directly → unauthorized data mutation or exfil - **Middleware bypass via `/_next/static/`** — middleware skips static asset paths → protected routes accessible via `/_next/data/` IDOR - **`/_next/image` SSRF** — Image optimizer fetches attacker-controlled URL → internal network scan or cloud metadata - **ISR stale cache poisoning** — inject malicious content into a cached page that gets served to all users - **RSC payload leakage** — React Server Component flight data contains server-side props not meant for client --- ## Attack Surface Signals ``` /_next/image?url=&w=&q= Image optimizer — SSRF candidate /_next/data/BUILD_ID/*.json Prerendered page data — IDOR candidate /__nextjs_original-stack-frame Debug stack frame endpoint /_next/static/chunks/ JS bundles — source map candidate /api/ API routes — standard hunt surface __NEXT_DATA__ in HTML SSR props leaked to client x-nextjs-* response headers Confirms Next.js ``` --- ## Phase 1 — Fingerprint & Version Detection ```bash # Confirm Next.js and get build ID curl -s https://$TARGET/ | grep -oP '"buildId":"[^"]+"' curl -sI https://$TARGET/ | grep -i "x-powered-by\|x-nextjs" # Extra...