hunt-rce

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

1. Ask the user to state the exact target URL, IP, account, or resource.
2. Ask the user to confirm written authorization and the permitted scope.
3. Show the exact command(s) and explain their expected effect.
4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Autonomous Testing Priority

Content-type is the #1 silent failure mode for command injection.

Traditional web forms use Content-Type: application/x-www-form-urlencoded. If you send a JSON body ({"host":"127.0.0.1;id"}) to a form endpoint, the server reads request.form['host'] and gets nothing — the app executes normally with no injection, returning a plausible 200 response. You get a false negative with no indication anything went wrong.

Rule: If the page has an HTML form (<form method="POST">), use form-encoding. If the path is /api/... or the response is JSON, use JSON.

Command injection operators to try (in order of prevalence):

value;id        ← Unix semicolon (most common)
value|id        ← pipe
value&&id       ← AND
value$(id)      ← subshell
value`id`       ← backtick

Proof: OS command output (uid=N(username) gid=...) in the response body confirms code execution. The output may be HTML-wrapped — that still counts. If the response is otherwise normal (200, expected content) with the command output appended or embedded, exploitation is confirmed.

Crown Jewel Targets

RCE vulnerabilities command the highest payouts in bug bounty programs because they grant attackers direct execution control over target infrastructure. The highest-value targets are:

Highest-paying asset types:

• Enterprise server products (GitHub Enterprise Server, self-hosted GitLab) — privilege escalation chains from low-privileged console roles to root SSH access consistently pay critical/high
• Supply chain / package registries — dependency confusion attacks against npm, PyPI, etc. hit critical severity across every major program
• Cloud-native infrastructure — exposed Kubernetes API servers, ingress controllers, and misconfiqured CI/CD pipelines
• Mobile app backends and OAuth flows — where server-side processing of attacker-controlled data meets execution contexts
• Admin/management consoles — template injection in configuration panels reaches root with a single payload

Why this class pays most:

• Blast radius is infrastructure-wide, not user-scoped
• Proof-of-concept is unambiguous — shell output is undeniable
• Fix requires architectural changes, not just a patch
• Programs cannot afford false negatives on RCE

Attack Surface Signals

URL Patterns

/management-console/*
/admin/settings/*
/api/v*/exec
/api/v*/run
/webhook/*
/_internal/*
/import?url=
/render?template=
/preview?format=

Response Headers / Tech Stack Signals

X-Powered-By: Express          # Node.js — npm dependency surface
X-Powered-By: Phusion Passenger
Server: nginx (ingress-nginx)  # Kubernetes ingress — path field injection
X-Runtime: Ruby                # Rails ActiveStorage, RDoc, REXML attack surface
Content-Type: application/yaml # YAML parsers (SnakeYAML, Psych) — deserialization
X-GitHub-Enterprise-Version    # GHAS — nomad template, collectd, syslog-ng injection

JavaScript / Frontend Signals

// Look for these patterns in JS bundles
fetch('/api/exec', {method:'POST', body: cmd})
eval(userInput) <!-- security-allowlist: documented payload technique reference, do not execute outside authorized scope -->
new Function(userInput)
document.write(unsafeData)
window.location = userControlled  // URL scheme bypass → JS execution

Tech Stack Signals

…