hunt-nodejs

# HUNT-NODEJS — Node.js Specific Vulnerabilities ## Crown Jewel Targets Prototype Pollution reaching a sink in Node.js backend = Critical RCE. **Highest-value chains:** - **Prototype Pollution → RCE** — `__proto__` injection via `lodash.merge` / `Object.assign` → polluted prototype reaches `child_process.exec` or `vm.runInNewContext` sink - **Express trust proxy** — `app.set('trust proxy', true)` without validation → attacker sets `X-Forwarded-For` to bypass IP allowlists or rate limits - **EJS/Pug SSTI** — template engine receives user input → `{{= process.mainModule.require('child_process').execSync('id') }}` - **`child_process` injection** — user input interpolated into shell command string → OS command injection - **`require()` path traversal** — attacker-controlled module path → load arbitrary file as JS --- ## Attack Surface Signals ``` X-Powered-By: Express Confirms Express.js Node.js in error messages Runtime detected package.json exposed Dependency list + versions /proc/self/environ accessible Environment variable exfil Error stack traces with .js paths Node.js confirmed __proto__ in JSON accepted Prototype pollution candidate ``` --- ## Phase 1 — Fingerprint ```bash # Confirm Node.js/Express curl -sI https://$TARGET/ | grep -i "x-powered-by\|nodejs\|express" # Check for package.json / node_modules exposure curl -s "https://$TARGET/package.json" curl -s "https://$TARGET/package-lock.json" curl -s "https://$TARGET/node...