菜单
Security testing playbook for Next.js covering App Router, Server Actions, RSC, and Edge runtime vulnerabilities
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Authorized AI penetration testing assistant for web applications, APIs, and infrastructure. Performs reconnaissance, vulnerability assessment, PoC validation, exploit chaining, and professional reporting. Use when the user asks for pentest, penetration test, security assessment, vulnerability scan, bug bounty research, authorized hacking, SQLi/XSS/IDOR/SSRF testing, API security audit, or exploit validation.
Authorized AI penetration testing for web apps, APIs, cloud, and infrastructure. Full kill-chain methodology with PoC validation, vulnerability chaining, and professional reporting. Triggers on: pentest, penetration test, security assessment, vuln scan, bug bounty, red team, authorized hack, SQL injection test, XSS test, IDOR, SSRF, API security, exploit validation, security audit.
Authorized AI penetration testing assistant — full-spectrum security testing with deep exploitation skills and integrated tooling. Use for web app pentests, API security, vuln validation, PoC development, bug bounty, and security assessments. Triggers on pentest, penetration test, security audit, exploit, SQLi, XSS, IDOR, SSRF.
API安全测试的专业技能和方法论
JWT and OIDC security testing covering token forgery, algorithm confusion, and claim manipulation
AWS cloud security testing covering IAM misconfigurations, S3 exposure, metadata abuse, and privilege escalation paths
| name | nextjs-security-testing |
| description | Security testing playbook for Next.js covering App Router, Server Actions, RSC, and Edge runtime vulnerabilities |
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
Security testing for Next.js applications. Focus on authorization drift across runtimes (Edge/Node), caching boundaries, server actions, and middleware bypass.
Routers
app/) and Pages Router (pages/) often coexistapp/api/**) and API routes (pages/api/**)middleware.ts at project rootRuntimes
Rendering & Caching
Data Paths
Next-Action header)getServerSideProps, getStaticPropsIntegrations
next/image optimization and remote loaders/api/auth/callback/*), sign-in providersRoute Discovery
// Browser console - list all routes
console.log(__BUILD_MANIFEST.sortedPages.join('\n'))
// Inspect server-fetched data
JSON.parse(document.getElementById('__NEXT_DATA__').textContent).props.pageProps
// List public environment variables
Object.keys(process.env).filter(k => k.startsWith('NEXT_PUBLIC_'))
Build Artifacts
GET /_next/static/<buildId>/_buildManifest.js
GET /_next/static/<buildId>/_ssgManifest.js
GET /_next/static/chunks/pages/
GET /_next/static/chunks/app/
Chunk filenames map to routes (e.g., admin.js → /admin).
Source Maps
Check /_next/static/ for exposed .map files revealing route structure, server action IDs, and internal functions.
Client Bundle Mining
Search main-*.js for: pathname:, href:, __next_route__, serverActions, API endpoints. Grep for API_KEY, SECRET, TOKEN, PASSWORD to find accidentally leaked credentials.
Server Action Discovery
Inspect Network tab for POST requests with Next-Action header. Extract action IDs from response streams and hydration data.
Additional Leakage
/sitemap.xml, /robots.txt, /sitemap-*.xml for unintended admin/internal/preview pathsKnown Techniques
x-middleware-subrequest header crafting (CVE-class bypass)x-nextjs-data probingx-middleware-rewrite/x-nextjs-redirect headersPath Normalization
/api/users
/api/users/
/api//users
/api/./users
Middleware may normalize differently than route handlers. Test double slashes, trailing slashes, dot segments.
Parameter Pollution
?id=1&id=2
?filter[]=a&filter[]=b
Middleware checks first value, handler uses last or array.
Cache Boundary Failures
no-store on sensitive fetchesFlight Data Leakage
Inspect streamed RSC payloads for serialized sensitive fields in props.
ISR Issues
revalidatePath/revalidateTagNextAuth Pitfalls
callbackUrl or mis-scoped allowed hostsSession Boundaries
NEXT_DATA Over-fetching
Server-fetched data passed to client but not rendered:
Environment-Dependent Exposure
Props Inspection
// Check for sensitive data in page props
JSON.parse(document.getElementById('__NEXT_DATA__').textContent).props
Look for _metadata, _internal, __typename (GraphQL), nested sensitive objects.
Remote Patterns
images.domains/remotePatterns in next.config.jsCustom Loaders
Edge vs Node
x-forwarded-* handling)XSS Vectors
dangerouslySetInnerHTMLHydration Mismatches
Server vs client render differences can enable gadget-based XSS.
application/json ↔ multipart/form-data ↔ application/x-www-form-urlencoded_method, X-HTTP-Method-Override, GET on endpoints accepting writes__BUILD_MANIFEST, source maps, build artifacts, sitemap/robots to map all routes__NEXT_DATA__ exposure: verify cross-user (User A's props shouldn't contain User B's PII), confirm exposed fields not in DOMpenkit51 AI — professional penetration testing skill pack. Authorized testing only.
Security testing for Next.js applications. Focus on authorization drift across runtimes (Edge/Node), caching boundaries, server actions, and middleware bypass.
Routers
app/) and Pages Router (pages/) often coexistapp/api/**) and API routes (pages/api/**)middleware.ts at project rootRuntimes
Rendering & Caching
Data Paths
Next-Action header)getServerSideProps, getStaticPropsIntegrations
next/image optimization and remote loaders/api/auth/callback/*), sign-in providersRoute Discovery
// Browser console - list all routes
console.log(__BUILD_MANIFEST.sortedPages.join('\n'))
// Inspect server-fetched data
JSON.parse(document.getElementById('__NEXT_DATA__').textContent).props.pageProps
// List public environment variables
Object.keys(process.env).filter(k => k.startsWith('NEXT_PUBLIC_'))
Build Artifacts
GET /_next/static/<buildId>/_buildManifest.js
GET /_next/static/<buildId>/_ssgManifest.js
GET /_next/static/chunks/pages/
GET /_next/static/chunks/app/
Chunk filenames map to routes (e.g., admin.js → /admin).
Source Maps
Check /_next/static/ for exposed .map files revealing route structure, server action IDs, and internal functions.
Client Bundle Mining
Search main-*.js for: pathname:, href:, __next_route__, serverActions, API endpoints. Grep for API_KEY, SECRET, TOKEN, PASSWORD to find accidentally leaked credentials.
Server Action Discovery
Inspect Network tab for POST requests with Next-Action header. Extract action IDs from response streams and hydration data.
Additional Leakage
/sitemap.xml, /robots.txt, /sitemap-*.xml for unintended admin/internal/preview pathsKnown Techniques
x-middleware-subrequest header crafting (CVE-class bypass)x-nextjs-data probingx-middleware-rewrite/x-nextjs-redirect headersPath Normalization
/api/users
/api/users/
/api//users
/api/./users
Middleware may normalize differently than route handlers. Test double slashes, trailing slashes, dot segments.
Parameter Pollution
?id=1&id=2
?filter[]=a&filter[]=b
Middleware checks first value, handler uses last or array.
Cache Boundary Failures
no-store on sensitive fetchesFlight Data Leakage
Inspect streamed RSC payloads for serialized sensitive fields in props.
ISR Issues
revalidatePath/revalidateTagNextAuth Pitfalls
callbackUrl or mis-scoped allowed hostsSession Boundaries
NEXT_DATA Over-fetching
Server-fetched data passed to client but not rendered:
Environment-Dependent Exposure
Props Inspection
// Check for sensitive data in page props
JSON.parse(document.getElementById('__NEXT_DATA__').textContent).props
Look for _metadata, _internal, __typename (GraphQL), nested sensitive objects.
Remote Patterns
images.domains/remotePatterns in next.config.jsCustom Loaders
Edge vs Node
x-forwarded-* handling)XSS Vectors
dangerouslySetInnerHTMLHydration Mismatches
Server vs client render differences can enable gadget-based XSS.
application/json ↔ multipart/form-data ↔ application/x-www-form-urlencoded_method, X-HTTP-Method-Override, GET on endpoints accepting writes__BUILD_MANIFEST, source maps, build artifacts, sitemap/robots to map all routes__NEXT_DATA__ exposure: verify cross-user (User A's props shouldn't contain User B's PII), confirm exposed fields not in DOMrecord_vulnerability when running inside the penkit51 platformrecord_vulnerability when running inside the penkit51 platform