Next.js Attack Probe

Authorized probe of a Next.js 13+ App Router app the user owns. Follow shared probing conventions — discover base URL from package.json scripts.dev (default next dev port 3000), next.config.{js,ts} serverRuntimeConfig, Dockerfile EXPOSE, or env (PORT). Never hardcode.

Next.js-specific attack surface

• NEXT_PUBLIC_* env vars are baked into the client JS bundle. Any secret with that prefix is leaked to anyone who fetches the site.
• Server Actions are reachable via crafted POSTs to any page, with Next-Action: <hash> header — no inherent auth.
• /_next/data/<buildId>/...json (Pages Router) and route handlers are often forgotten in middleware matchers.
• next/image proxy can be coerced into SSRF if images.remotePatterns is too permissive.
• ISR revalidatePath/revalidateTag with user-influenced paths → cache poisoning.
• x-middleware-subrequest header bypass (CVE-2025-29927 class) — Next.js < 15.1 patches.

Procedure

1. Authorization preflight + base URL discovery.
2. Pull build manifest: GET /_next/static/chunks/*.js (sample 1-2 main bundles); grep for NEXT_PUBLIC_ and obvious secret shapes.
3. Probe per rule table.