Nestjs Attack Probe

NestJS Attack Probe

Authorized probe of a NestJS 10.x/11.x app the user owns. Follow shared probing conventions — discover base URL from main.ts app.listen(...), process.env.PORT, Dockerfile EXPOSE, or nest-cli.json. Never hardcode.

NestJS-specific attack surface

• Validation is opt-in: app.useGlobalPipes(new ValidationPipe()) without whitelist: true allows extra fields to flow through to handlers, defeating DTO-based validation.
• Guards are opt-in: @UseGuards() on a controller class is per-class; per-method overrides + a missed method = anonymous endpoint.
• @nestjs/swagger auto-mounts /api (or configured path) — by default unauthenticated.
• WebSocket Gateways don't use the HTTP guard chain; they need their own auth in handleConnection.
• @ApiBearerAuth() decorator is documentation only; it does not enforce the bearer token.

Procedure

1. Authorization preflight + base URL discovery.
2. Fetch Swagger if exposed: try /api, /api/docs, /swagger, /docs. The OpenAPI JSON is usually at <docs>/json or /api-json.
3. Probe per rule table.

Rules

Wrong vs. right

NEST-PIPE-001 (extra-field bypass)

// ❌ main.ts — pipe registered without whitelist
app.useGlobalPipes(new ValidationPipe());

// ✅
app.useGlobalPipes(new ValidationPipe({
  whitelist: true,
  forbidNonWhitelisted: true,
  transform: true,
}));

NEST-AUTH-001 (per-method guard miss)

// ❌ Class guard, but one method missing decoration override + decorator removed
@Controller("orders")
@UseGuards(JwtAuthGuard)
export class OrdersController {
  @Get() list() { /* guarded */ }
  @Public()                        // someone added this for tests, forgot to remove
  @Delete(":id") remove() { /* now anonymous */ }
}

// ✅
@Controller("orders")
@UseGuards(JwtAuthGuard, RolesGuard)
export class OrdersController {
  @Get() list() { /* ... */ }
  @Roles("admin")
  @Delete(":id") remove() { /* ... */ }
}

References

• NestJS Validation: https://docs.nestjs.com/techniques/validation
• NestJS Guards: https://docs.nestjs.com/guards
• NestJS WebSockets: https://docs.nestjs.com/websockets/gateways
• @nestjs/swagger: https://docs.nestjs.com/openapi/introduction