Pentesting Next.js Server Actions — A Burp Extension for Has...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.adversis.io/blogs/pentesting-next-js-server-actions
• Blog Title: Pentesting Next.js Server Actions — A Burp Extension for Hash-to-Function Mapping
• Suggested Section: Web Pentesting -> JavaScript/Source Map Leakage -> Next.js Server Actions Enumeration (Burp extension and regex mapping)

🎯 Content Summary

What this post delivers: a practical method and a Burp Suite extension (NextjsServerActionAnalyzer) to deanonymize Next.js Server Actions by mapping the hashed IDs sent in the Next-Action header to their original function names whenever productionBrowserSourceMaps is enabled. This turns opaque POSTs into named targets for focused testing.

Why Server Actions are hard to test: Unlike REST endpoints (e.g., GET /api/user/1), Next.js Serve...

🔧 Technical Details

Deanonymize Next.js Server Actions via source maps + regex: When productionBrowserSourceMaps is enabled, scan minified JS for createServerReference(...) and extract hash → functionName with regex:

createServerReference\)\("([a-f0-9]{40,})",\w+\.callServer,void 0,\w+\.findSourceMapURL,"([^"]+)"\)
createServerReference[^"]*"([a-f0-9]{40,})"[^"]*"([^"]+)"\s*\)

Use the mapping to translate Next-Action header values into concrete targets (e.g., deleteUserAccount(), exportUserData()). Tool: NextjsServerActionAnalyzer.

Template-based request generation to exercise hidden actions: Take a valid POST containing Next.js headers as a template, replace its Next-Action value with the discovered hash, and replay in Burp Repeater to probe authZ, input validation, and business logic for otherwise...

🤖 Agent Actions

I analyzed the repository and found the best place to incorporate this technique is the existing Next.js page:

• src/network-services-pentesting/pentesting-web/nextjs.md

There was no prior coverage of Next.js Server Actions deanonymization or workflows based on the Next-Action header and source maps. Related content on source maps existed under Angular and XSS pages, but nothing specific for Next.js Server Actions. Therefore, I updated the Next.js page to include a concise, highly technical section on enumerating and testing Server Actions via source maps and regex, and I added a References section per guidelines.

Summary of changes implemented:

• Added a new section: “Next.js Server Actions Enumeration (hash to function name via source maps)”
  • Explained why Server Actions are opaque (Next-Action header) and how hashes rotate per build
  • Provided strict and flexible regex patterns to extract hash→function mappings from minified bundles
  • Described a practical workflow to build a hash↔name dictionary and exercise hidden actions by swapping the Next-Action header
  • Documented automation via the NextjsServerActionAnalyzer Burp extension with features (passive discovery, cross-build de-duplication, template-based Repeater requests)
  • Included limitations/notes (requires productionBrowserSourceMaps; disclosure is not a vuln by itself)
• Added a References section at the end of the file (before the final banner include) with:
  • Blog: https://www.adversis.io/blogs/pentesting-next-js-server-actions
  • Tool: https://github.com/Adversis/NextjsServerActionAnalyzer

Files modified:

• src/network-services-pentesting/pentesting-web/nextjs.md

No new files were created since the existing Next.js page was the most relevant and appropriate location for this content.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.adversis.io/blogs/pentesting-next-js-server-actions

Content Categories: Based on the analysis, this content was categorized under "Web Pentesting -> JavaScript/Source Map Leakage -> Next.js Server Actions Enumeration (Burp extension and regex mapping)".

Repository Maintenance:

• MD Files Formatting: 906 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0