hunt-rce
starsforks
How to install hunt-rce?
elementalsouls/claude-bughunter/hunt-rce
$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-rceHunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.
SKILL.md
| 1 | ## Autonomous Testing Priority |
| 2 | |
| 3 | **Content-type is the #1 silent failure mode for command injection.** |
| 4 | |
| 5 | Traditional web forms use `Content-Type: application/x-www-form-urlencoded`. If you send a JSON body (`{"host":"127.0.0.1;id"}`) to a form endpoint, the server reads `request.form['host']` and gets nothing — the app executes normally with no injection, returning a plausible 200 response. You get a false negative with no indication anything went wrong. |
| 6 | |
| 7 | **Rule:** If the page has an HTML form (`<form method="POST">`), use form-encoding. If the path is `/api/...` or the response is JSON, use JSON. |
| 8 | |
| 9 | **Command injection operators to try (in order of prevalence):** |
| 10 | ``` |
| 11 | value;id ← Unix semicolon (most common) |
| 12 | value|id ← pipe |
| 13 | value&&id ← AND |
| 14 | value$(id) ← subshell |
| 15 | value`id` ← backtick |
| 16 | ``` |
| 17 | |
| 18 | **Proof:** OS command output (`uid=N(username) gid=...`) in the response body confirms code execution. The output may be HTML-wrapped — that still counts. If the response is otherwise normal (200, expected content) with the command output appended or embedded, exploitation is confirmed. |
| 19 | |
| 20 | --- |
| 21 | |
| 22 | ## Crown Jewel Targets |
| 23 | |
| 24 | RCE vulnerabilities command the highest payouts in bug bounty programs because they grant attackers direct execution control over target infrastructure. The highest-value targets are: |
| 25 | |
| 26 | **Highest-paying asset types:** |
| 27 | - **Enterprise server products** (GitHub Enterprise Server, self-hosted GitLab) — privilege escalation chains from low-privileged console roles to root SSH access consistently pay critical/high |
| 28 | - **Supply chain / package registries** — dependency confusion attacks against npm, PyPI, etc. hit critical severity across every major program |
| 29 | - **Cloud-native infrastructure** — exposed Kubernetes API servers, ingress controllers, and misconfiqured CI/CD pipelines |
| 30 | - **Mobile app backends and OAuth flows** — where server-side processing of attacker-controlled data meets execution contexts |
| 31 | - **Admin/management consoles** — template injection in configuration panels reaches root with a single payload |
| 32 | |
| 33 | **Why this class pays most:** |
| 34 | - Blast radius is infrastructure-wide, not user-scoped |
| 35 | - Proof-of-concept is unambiguous — shell output is undeniable |
| 36 | - Fix requires architectural changes, not just a patch |
| 37 | - Programs cannot afford false negatives on RCE |
| 38 | |
| 39 | --- |
| 40 | |
| 41 | ## Attack Surface Signals |
| 42 | |
| 43 | ### URL Patterns |
| 44 | ``` |
| 45 | /management-console/* |
| 46 | /admin/settings/* |
| 47 | /api/v*/exec |
| 48 | /api/v*/run |
| 49 | /webhook/* |
| 50 | /_internal/* |
| 51 | /import?url= |
| 52 | /render?template= |
| 53 | /preview?format= |
| 54 | ``` |
| 55 | |
| 56 | ### Response Headers / Tech Stack Signals |
| 57 | ``` |
| 58 | X-Powered-By: Express # Node.js — npm dependency surface |
| 59 | X-Powered-By: Phusion Passenger |
| 60 | Server: nginx (ingress-nginx) # Kubernetes ingress — path field injection |
| 61 | X-Runtime: Ruby # Rails ActiveStorage, RDoc, REXML attack surface |
| 62 | Content-Type: application/yaml # YAML parsers (SnakeYAML, Psych) — deserialization |
| 63 | X-GitHub-Enterprise-Version # GHAS — nomad template, collectd, syslog-ng injection |
| 64 | ``` |
| 65 | |
| 66 | ### JavaScript / Frontend Signals |
| 67 | ```javascript |
| 68 | // Look for these patterns in JS bundles |
| 69 | fetch('/api/exec', {method:'POST', body: cmd}) |
| 70 | eval(userInput) |
| 71 | new Function(userInput) |
| 72 | document.write(unsafeData) |
| 73 | window.location = userControlled // URL scheme bypass → JS execution |
| 74 | ``` |
| 75 | |
| 76 | ### Tech Stack Signals |
| 77 | | Signal | RCE Vector | |
| 78 | |--------|-----------| |
| 79 | | `nomad` in config UI | Template injection → `{{ ... }}` | |
| 80 | | `syslog-ng` config editable | Config injection → `program()` destination | |
| 81 | | `collectd` config editable | Plugin exec injection | |
| 82 | | `SnakeYAML` in classpath | `!!javax.script.ScriptEngineManager [...]` | |
| 83 | | npm `package.json` internal scope | Dependency confusion | |
| 84 | | ingress-nginx annotations | Path field regex bypass | |
| 85 | |
| 86 | --- |
| 87 | |
| 88 | ## Step-by-Step Hunting Methodology |
| 89 | |
| 90 | 1. **Map the execution contexts first.** Before testing payloads, identify everywhere user-controlled input touches an execution layer: template engines, shell commands, YAML parsers, file paths used in operations, package resolution, and configuration files. |
| 91 | |
| 92 | 2. **Enumerate admin/management interfaces.** Crawl for `/management-console`, `/admin`, `/_internal`, `/setup`, `/config`. These surfaces are lower-auth and higher-privilege — the GHES cluster produced 6 separate RCEs from one console role. |
| 93 | |
| 94 | 3. **Check template injection in every config field.** In any management UI that accepts free-form configuration (log destinations, notification formats, proxy settings), submit `{{7*7}}`, `${7*7}`, `<%= 7*7 %>`. Look for `49` in responses, logs, or DNS callbacks. |
| 95 | |
| 96 | 4. **Test YAML/XML/serialized input for code execution.** Any endpoint accepting `Content-Type: application/yaml` or `application/xml`: |
| 97 | - SnakeYAML: submit `!!javax.script.ScriptEngineManager` gadget |
| 98 | - Ruby YAML: submit `!ruby/object:Gem::Installer` gadget |
| 99 | - REXM |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
