hunt-nestjs

name	hunt-nestjs
description	Hunt NestJS-specific vulnerabilities: guard bypass, decorator gaps, and microservice auth drift.
category	redteam
version	1.1.0
revision_date	"2026-07-25T00:00:00.000Z"
license	MIT
platforms	["linux"]
compatibility	Requires curl, python3
tags	["redteam","nestjs","TypeScript","decorator","guard","microservice","GraphQL"]
related_skills	["hunt-graphql","hunt-api-misconfig","hunt-idor","hunt-write-gap"]

NestJS Security Hunting

Hunt NestJS-specific vulnerabilities in guard bypass via decorator stack gaps, Reflector metadata mismatches between global/controller/method guards, ValidationPipe whitelist and transform exploits, and microservice transport authentication drift. NestJS's architectural patterns — decorators, dependency injection, module system, multi-transport support — create unique attack surface across HTTP, WebSocket, and RPC transports.

When to Use

• Target uses NestJS (indicated by x-powered-by: NestJS or TypeScript decorator patterns in error messages).
• GraphQL endpoints exist alongside REST API.
• Microservice transports (TCP, Redis, NATS, MQTT, gRPC) are configured.
• Swagger/OpenAPI docs are exposed at /api or /api-json.
• CRUD endpoints follow predictable NestJS naming conventions.

Quick Detection

# NestJS fingerprinting
curl --max-time 30 --connect-timeout 10 -skI "https://target.com/api" | grep -iE "x-powered-by|server"
# Look for: x-powered-by: NestJS

# Swagger docs
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api" -w "%{http_code}\n" -o /dev/null
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api-json" | jq '.paths | keys[]' 2>/dev/null

Procedure

Phase 1 — Guard Bypass via Decorator Stack Gaps

# NestJS guard resolution: global → controller → method
# A @Public() or @SkipAuth() on one method doesn't affect others
# BUT: route parameter confusion can bypass guards

# Test all HTTP methods on guarded endpoints
for method in GET POST PUT PATCH DELETE OPTIONS; do
  curl --max-time 30 --connect-timeout 10 -sk -X "$method" "https://target.com/api/admin/users" \
    -w "$method — %{http_code}\n" -o /dev/null
done

# Controller-level guard with method-level override
curl --max-time 30 --connect-timeout 10 -sk      
curl --max-time 30 --connect-timeout 10 -sk