SPA / Next.js / React Hunting
The HTML is a shell. Routes, server actions, and /_next/data are the app.
Tags: spa, nextjs, react, js
Level: advanced
Method
Rebuild source
Maps, _next/static chunks, RSC payloads. Get original component names.
Tools: sourcemapper, getJS, katana
Route table
Next.js pages, app router, rewrites in next.config (often inlined). Hit /_next/data/{buildId}/....json.
Server actions / API routes
POST to /api/* and Next server actions (the hashed IDs in the JS). Replay with another user's cookies.
Tools: Burp Suite
Middleware vs page auth
Middleware that only redirects the document, not the data route or the action.
Field notes
- A 404 HTML with a 200 JSON behind /_next/data is a classic miss.
- Prototype pollution in client bundles plus a sink in the same app is still in play on older deps.