domains / families / security / hunt-rce

hunt-rce

combined

Hunting skill for rce vulnerabilities. Built from 67 public bug bounty Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.
• Use when the target has any endpoint that processes user-controlled input through an execution layer — template engines, shell commands, YAML/XML parsers, file paths used in operations, package resolution, or configuration files. RCE is th…

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

The two copies share the same core RCE hunting methodology, crown jewel targets, and attack surface signals, but each contains material steps the other lacks. The uphiago copy provides a complete 10-step methodology including dependency confusion, file path traversal, Kubernetes auditing, OAuth redirect testing, and out-of-band verification. The sickn33 copy adds a mandatory authorization confirmation gate, a content-type failure mode warning, and a specific list of command injection operators with proof criteria. Crowning one copy would hide the other's unique constraints and steps.