NestJS Attack Probe

Authorized probe of a NestJS 10.x/11.x app the user owns. Follow shared probing conventions — discover base URL from main.ts app.listen(...), process.env.PORT, Dockerfile EXPOSE, or nest-cli.json. Never hardcode.

NestJS-specific attack surface

• Validation is opt-in: app.useGlobalPipes(new ValidationPipe()) without whitelist: true allows extra fields to flow through to handlers, defeating DTO-based validation.
• Guards are opt-in: @UseGuards() on a controller class is per-class; per-method overrides + a missed method = anonymous endpoint.
• @nestjs/swagger auto-mounts /api (or configured path) — by default unauthenticated.
• WebSocket Gateways don't use the HTTP guard chain; they need their own auth in handleConnection.
• @ApiBearerAuth() decorator is documentation only; it does not enforce the bearer token.

Procedure

1. Authorization preflight + base URL discovery.
2. Fetch Swagger if exposed: try /api, /api/docs, /swagger, /docs. The OpenAPI JSON is usually at <docs>/json or /api-json.
3. Probe per rule table.

Rules