hunt-rce

Map execution contexts first: template engines, shell commands, YAML parsers, and file operations that receive user input. Submit probes like {{7*7}} for template injection and confirm blind RCE with out-of-band DNS callbacks via interactsh or Burp Collaborator.

Submit polyglot probes like {{7*7}}${7*7}<%= 7*7 %> into every free-form field, especially admin configuration panels. Look for 49 in responses, logs, or DNS callbacks to confirm server-side evaluation.

Dependency confusion exploits internal package names that are unregistered on public registries. Enumerate internal package names from JS bundles and package.json files, then publish a higher-versioned package with a canary callback to detect execution on build infrastructure.

Yes, SnakeYAML's default constructor supports arbitrary object instantiation. Submitting a !!javax.script.ScriptEngineManager gadget with a URLClassLoader to an endpoint parsing YAML can load remote code unless a safe loader is configured.

Reports fail when impact is unproven or reproduction is unreliable. Demonstrate concrete execution via id output or a unique DNS callback, articulate what the victim loses, and ensure the proof-of-concept reproduces in under 10 minutes.

Chain SSRF when the execution sink is internal-only, such as cloud metadata endpoints or localhost admin consoles. The Capital One pattern combines SSRF with IMDSv1 credential theft and Lambda invocation to reach backend code execution.