hunt-spa-api
Installation
SKILL.md
When to use this skill
Trigger when:
- A target host returns a tiny HTML shell + big
/static/js/*.jsor/_next/static/*bundles (React/Vue/Angular/Next/Svelte SPA) - You see a subdomain named
console,app,dashboard,portal,admin,panel,manage,internal - Recon surfaces any
*api*,*-api*,api.*host - A login page is OAuth/SSO-gated (the frontend auth tells you nothing about whether the API enforces auth)
The core insight: a SPA is a client to a backend API, and it ships the full map of that API — hosts, routes, sometimes keys — to anyone who views source. The login page being protected says nothing about whether the API behind it checks tokens. Auth is frequently enforced on the gateway/login and missing on a route group of the API.
DO NOT skip this because "the app needs login" — that's exactly when this pays off.