Hunt Node.js code injection vulnerabilities
hunt-nodejsskillsetup L3★1,791
elementalsouls/Claude-BugHunter ↗What it does
Hunt Node.js prototype pollution, SSTI, child_process injection, and path traversal
Best for
Chaining prototype pollution to RCE on Express apps with unsafe merge operations.
Inputs
- · Target endpoint
- · __proto__ payload
- · Template injection test
Outputs
- · RCE payload
- · Exploitation proof
Requires
- · curl
- · Burp
- · child_process test harness
Preconditions
- · Node.js confirmed via headers/errors
- · Entry point identified
Failure modes
- · Lodash version not vulnerable
- · Template engine disabled
Trust signals
- · __proto__ injection test
- · sink tracing (child_process/vm)