domains / families / security / hunt-laravel

hunt-laravel

combined

Hunt Laravel specific vulnerabilities Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthorized access, Ignition RCE (CVE-2021-3129), Signed URL manipulation, Queue Worker abuse, mass assignment via Eloquent, deserialization via cookies, .env file exposure. Use when target runs Laravel (PHP) — detected via X-Powered-By, Laravel session cookies, or /storage/ paths.

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

Both copies implement the same Laravel red-team procedure (fingerprinting, Ignition RCE, Telescope/Horizon, .env/APP_KEY, signed URLs). The uphiago copy is the more complete, self-contained procedure with explicit timeouts and a signed-URL phase, while the sickn33 copy adds a mandatory authorization gate and an extra CVE-2024-52301 environment-override phase that the other lacks. Crowning one would hide either the authorization constraint or the additional CVE, so the copies should be combined.