What problem does it solve? Next.js applications expose framework-specific attack surfaces—Server Actions, middleware, image optimization, ISR caching, and prerendered data endpoints—that generic web vulnerability scans often miss, leaving auth bypasses and SSRF flaws undetected. ## Core Features & Use Cases - Framework-Specific Attack Phases: Eight structured phases covering fingerprinting, Server Actions abuse, middleware auth bypass (including CVE-2025-29927), /_next/image SSRF, /_next/data/ IDOR, ISR cache poisoning, debug endpoints, and environment variable leakage. - False-Positive Guards: Built-in validation rules prevent misreporting, such as requiring out-of-band callback confirmation for SSRF and distinguishing dev-mode-only debug endpoints from real findings. - Use Case: During an authorized bug bounty engagement against a Next.js 14 target, follow the phases to extract the build ID, test Server Actions without a session, probe middleware-gated admin routes, and confirm an image optimizer SSRF via a unique Collaborator callback. ## Quick Start Ask the agent to run the Next.js hunting workflow against your authorized target domain, starting with fingerprinting and build ID extraction.
