Express Attack Probe

Authorized probe of an Express.js app the user owns. Follow shared probing conventions — discover base URL via env / package.json scripts.dev / Dockerfile. Never hardcode the port.

Express-specific attack surface

• Middleware order is silently security-critical: routes registered before auth bypass it entirely.
• req.body is Object-prototype-mergeable in apps using lodash.merge / Object.assign(target, req.body) — prototype pollution → privilege escalation when the merged object is later checked for isAdmin.
• qs (default Express query parser) parses ?a[b][c]=1 into nested objects up to depth 5; can cause CPU bombs and bypass naive type checks.
• trust proxy set to true lets attackers spoof req.ip / X-Forwarded-For, defeating per-IP rate-limit / geo-block.
• res.sendFile / res.download without containment leaks files outside the intended root.

Procedure

1. Authorization preflight + base URL discovery.
2. Identify routes (parse app.use/app.get/router.* in source if available, else crawl).
3. Probe per the rule table; stop at request budget.

Rules