The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2023-11-06 2023 | The toddlers introduction to Heap exploitation (Part 1) beginner | The toddler’s introduction to Heap exploitation (Part 1) https://ift.tt/OhuPqgT |
| 2023-11-05 2023 | Offensive C# beginner Bug Bounty | Course on Offensive C# covering malware development, C2 creation, Active Directory enumeration and attacks, .NET loaders, persistence, WinAPI interaction, token enumeration, shellcode and DLL injection, PE backdooring, PE parsing, PE64 loading, process hollowing, and API hooking and hashing. |
| 2023-10-27 2023 | Perfect DLL Hijacking intermediate 42 min read | Library that details a novel technique for DLL hijacking that circumvents the limitations of Windows' Loader Lock by reverse-engineering the Windows library loader. This research builds upon prior work like Nick Landers' "Adaptive DLL Hijacking" and presents a data-only approach that avoids problematic actions such as changing memory protection with VirtualProtect or modifying pointers, which are often flagged by anti-malware or incompatible with exploit mitigations like Intel CET. The library also offers stable mitigation and detection mechanisms for defenders. |
| 2023-10-18 2023 | Empire beginner | Empire https://ift.tt/Qmfzot3 |
| 2023-10-13 2023 | Understanding File Upload Vulnerabilities in Web App Penetration Testing | 2023 beginner | Understanding File Upload Vulnerabilities in Web App Penetration Testing | 2023 https://ift.tt/8aVoHYJ → cyberw1ng.medium.com |
| 2023-09-22 2023 | How to turn SQL injection into an RCE or a file read? Case study of 128 bug bounty reports intermediate Bug Bounty SQLi Talks | How to turn SQL injection into an RCE or a file read? Case study of 128 bug bounty reports https://www.youtube.com/watch?v=ClnVdYf4PK0 |
| 2023-08-21 2023 | Journey into Windows Kernel Exploitation: The Basics beginner | Journey into Windows Kernel Exploitation: The Basics https://ift.tt/IyEYMN5 |
| 2023-07-22 2023 | ProcessInjection intermediate 1 min read | Tool implementing five process injection techniques: Vanilla, DLL, Process Hollowing, APC Queue, and KernelCallbackTable. It accepts shellcode in base64, hex, C, or raw formats, and supports P/Invoke, D/Invoke, Direct Syscalls, and Indirect Syscalls for injection. The tool also includes detection evasion through XOR or AES encryption, and Parent PID Spoofing, with the option to load via reflection from disk or a remote server. |
| 2023-04-03 2023 | Basic and Low-level Python Network Attacks beginner Python | https://ift.tt/SxGhvBQ |
| 2023-04-02 2023 | $10.000 bounty for exposed .git to RCE intermediate Bug Bounty | $10.000 bounty for exposed .git to RCE https://ift.tt/1AxW3QH |
| 2022-04-06 2022 | Favorite tweet by @hakluke beginner Bug Bounty | Favorite tweet: I see people confuse these terms all the time, so I wrote a reference-style blog about it! The difference between code injection, command injection, RCE, remote code execution and rem... |
| 2022-02-28 2022 | Favorite tweet by @NandanLohitaksh intermediate Bug Bounty | Favorite tweet: Top 25 Remote Code Execution (RCE) Parameters 1. ?cmd={payload} 2. ?exec={payload} 3. ?command={payload} 4. ?execute={payload} 5. ?ping={payload} 6. ?query={payload} 7. ?jump={payload... |
| 2022-01-17 2022 | Log4Pot beginner 1 min read | Honeypot for Log4Shell (CVE-2021-44228) that listens for exploitation attempts on various ports, detects malicious requests in lines and headers, and recursively downloads exploit payloads. It supports logging to files and Azure blob storage, with an included analyzer script to extract and decode payloads, and build timelines. Installation involves fetching the repository and using Poetry for dependency management. |
| 2022-01-03 2022 | Malicious PDF Generator intermediate | Tool for generating ten distinct malicious PDF files, each with phone-home functionality, designed for penetration testing and red-teaming. This application facilitates testing web pages and services that accept PDF uploads, security products, PDF readers, and PDF converters by creating sample files with embedded links that can be configured to point to a Burp Collaborator URL. |
| 2022-01-02 2022 | a c program containing vulnerable code for common types of vulnerabilities can be used to show fuzzing concepts. beginner 3 min read Fuzzing | Program containing vulnerable C code to demonstrate fuzzing concepts. This resource includes code for common vulnerabilities such as integer overflow/underflow, out-of-bounds read/write, double free, use-after-free, memory leaks, and stack/heap exhaustion. It is designed to be fuzzed using tools like AFL, libafl, libfuzzer, and honggfuzz, with instructions and video tutorials provided for setup and execution. |
| 2021-12-31 2021 | InfosecMindmaps/Log4shell at main DickReverse/InfosecMindmaps beginner | InfosecMindmaps/Log4shell at main DickReverse/InfosecMindmaps |
| 2021-12-31 2021 | Log4Shell Visualization beginner | Log4Shell Visualization |
| 2021-12-30 2021 | Golang Offensive Tools with C-Sto and capnspacehook intermediate Python | Library of offensive security tools built with Golang, showcasing work from developers like C-Sto (goWMIexec, BananaPhone, gosecretsdump) and capnspacehook (pandorasbox, garble). The resource covers challenges and future directions of Go malware, listing numerous tools for command and control, obfuscation, reverse engineering, and more, including notable projects like sliver and DeimosC2. |
| 2021-12-16 2021 | Mitigate Log4j2 / Log4Shell in Elasticsearch intermediate 16 min read Supply Chain | Analysis of Log4Shell (CVE-2021-44228) vulnerabilities in Elasticsearch versions 5.0 to 7.16.0. Discusses mitigation strategies including updating Log4j to 2.17.1, setting `log4j2.formatMsgNoLookups=true`, removing the `JndiLookup` class, and leveraging the Java Security Manager's protections. Explains why subsequent Log4j issues (CVE-2021-45046, CVE-2021-45105, CVE-2021-44832) have limited impact on Elasticsearch due to its configuration and security measures. Recommends upgrading Elasticsearch to versions ≥ 7.16.3 or ≥ 6.8.23 for full patching. |
| 2021-12-13 2021 | Semgrep beginner Supply Chain | Semgrep |
| 2021-12-13 2021 | Log4Shell The Worst Java Vulnerability in Years beginner | Log4Shell The Worst Java Vulnerability in Years |
| 2021-12-13 2021 | Java log4j security: Added Lookup injection rule. #1650 intermediate | Library of Semgrep rules designed to detect and prevent Log4j Lookup injection vulnerabilities in Java applications. This includes a specific rule (ID 1650) to address added lookup injections, enhancing static analysis for securing Java codebases against common Log4j exploits. |
| 2021-12-12 2021 | Log4j: Its worse than you think beginner 6 min read | Library of vulnerability scanner rules for detecting CVE-2021-4428 (Log4j), a critical Java package vulnerability. This tool leverages a partial trigger of the exploit to identify vulnerable instances, with a focus on providing remote scanning services to customers. Mitigation advice includes upgrading Log4j, disabling lookups, removing dangerous class files, and blocking JNDI lookup prefixes at the WAF. |
| 2021-12-12 2021 | Digging deeper into Log4Shell - 0Day RCE exploit found in Log4j intermediate 6 min read Supply Chain | Writeup detailing CVE-2021-44228, a remote code execution vulnerability in Apache Log4j. This widespread flaw enables attackers to execute arbitrary code by controlling log messages, leveraging JNDI lookups that can trigger LDAP or DNS calls to load malicious Java classes. The writeup describes the attack mechanism, observed exploitation tactics including targeting User-Agent headers, and mitigation strategies such as patching or disabling lookups. |
| 2021-12-12 2021 | PSA: Log4Shell and the current state of JNDI injection beginner 2 min read Supply Chain | Analysis of CVE-2021-44228 (Log4Shell), detailing how JNDI injection vulnerabilities in Log4j allow remote code execution. It highlights that even recent Java runtimes are susceptible, particularly through RMI and LDAP lookups. The analysis covers historical Java patches like CVE-2009-1094 and CVE-2018-3149, and discusses exploitation vectors using Apache XBean BeanFactory and Java deserialization, affecting environments like Apache Tomcat and WebSphere. |
| 2021-12-06 2021 | How to Brute-Force SSH Servers in Python intermediate 3 min read Python | Library for brute-forcing SSH servers in Python using the `paramiko` library. The tutorial details how to create a script that attempts password combinations from a provided wordlist against a target SSH host. It covers handling connection timeouts, authentication failures, and rate limiting, and includes argument parsing for host, username, and password list input. |
| 2021-11-26 2021 | Phantom - A multi-platform HTTP(S) Reverse Shell Server and Client intermediate 3 min read API Sec | Library for building multi-platform HTTP(S) reverse shells. Phantom allows creation of standalone Linux and Windows binaries using PyInstaller, supporting both auto-generated and user-supplied certificates for encrypted HTTPS communication. It includes a helper script for certificate generation and a straightforward build process via `build.py`, which can use Poetry or Virtualenv for dependency management. Client binaries can connect to specified server URLs, facilitating stealthy connections. |
| 2021-11-11 2021 | Game Hacking with Python and cheat engine intermediate Python | Game Hacking with Python and cheat engine |
| 2021-09-24 2021 | Buffer Overflow using ShellCraft - TryHackMe Intro to Pwntools beginner | Buffer Overflow using ShellCraft - TryHackMe Intro to Pwntools |
| 2021-09-05 2021 | Writing an iOS Kernel Exploit from Scratch advanced 43 min read Mobile | Library for creating an iOS kernel exploit from scratch, specifically focusing on chain #3 against a double-free vulnerability present in iOS 11 and mitigated in 11.4.1. This resource details setting up a test environment, analyzing the IOKit driver vulnerability and its trigger, and developing a full exploit using common techniques, including a sandbox escape method revealed by Siguza. It serves as a reference for beginners by filling potential gaps in exploit development knowledge. |
| 2021-08-18 2021 | remote-method-guesser: A Java RMI Vulnerability Scanner intermediate | remote-method-guesser: A Java RMI Vulnerability Scanner |
| 2021-05-31 2021 | Finding writable folders and hijackable DLLs intermediate | This content discusses security vulnerabilities related to identifying writable folders and DLL hijacking opportunities on a system. These vulnerabilities can be exploited by attackers to gain elevated privileges or execute malicious code. The process likely involves scanning file systems for improperly configured permissions and analyzing the search paths for dynamic-link libraries (DLLs) to find instances where an attacker could substitute a malicious DLL for a legitimate one. |
| 2021-01-20 2021 | Learn About Command Injection Attacks beginner | The content discusses command injection attacks where attackers can run their code on a victim's machine. This type of attack allows malicious actors to execute arbitrary commands on a system, potentially leading to unauthorized access, data theft, or system compromise. It is crucial to understand and protect against command injection vulnerabilities to prevent security breaches and safeguard sensitive information. |
| 2020-05-31 2020 | r/Hacking_Tutorials - Remote Code Execution explained with real life bug bounty reports beginner Bug Bounty | The Reddit post titled "r/Hacking_Tutorials - Remote Code Execution explained with real life bug bounty reports" has received 36 votes but no comments yet. The post likely discusses remote code execution vulnerabilities using real-life bug bounty reports. It aims to provide tutorials and insights into how these vulnerabilities can be exploited, potentially offering valuable information for those interested in hacking and cybersecurity. |
| 2019-10-05 2019 | SQL injection to RCE intermediate SQLi | The content discusses a case of SQL injection leading to Remote Code Execution (RCE) discovered during a recent customer penetration testing. It hints at the potential security vulnerability and the impact it had on the system. |
| 2019-08-28 2019 | WRITE UP – Private bug bounty $$,$$$ USD: “RCE as root on Marathon-Mesos instance” – @omespino intermediate 2 min read | Writeup detailing a private bug bounty win of $30,000 USD for a Remote Code Execution (RCE) as root vulnerability found on a Marathon-Mesos instance. The exploit involved using Shodan to locate unauthenticated Marathon UIs, then crafting a `curl` command to create a Marathon application that executed `/usr/bin/wget --post-data='id'` to a listener, demonstrating root-level command execution via this container orchestration platform. Tools used included netcat, curl, and a web browser. |
| 2019-04-20 2019 | PDFReacter SSRF to ROOT Level Local File Read which led to RCE intermediate SSRF | PDFReacter is a parser that converts HTML content to PDF. |
| 2018-11-09 2018 | elttam - Ruby 2.x Universal RCE Deserialization Gadget Chain advanced 11 min read | Library for Ruby 2.x universal RCE deserialization gadget chains, detailing exploitation of arbitrary deserialization and releasing a public gadget chain for command execution. It discusses serialization, deserialization pitfalls, and code reuse attacks via gadget chains, noting limitations of previous payloads requiring specific gems and libraries. This resource explores hunting for gadgets within the standard library, focusing on techniques that implicitly load additional libraries or allow partial control over arguments to `require`. |
| 2018-07-06 2018 | Latex to RCE, Private Bug Bounty Program intermediate | The content discusses the author's participation in a private bug bounty program focused on a CMS journal site, approximately a year ago. The author aims to share their learnings from this experience, particularly related to exploiting a vulnerability in Latex to achieve Remote Code Execution (RCE). The bug bounty program provided an opportunity for the author to enhance their skills in identifying and exploiting security flaws. |
| 2018-06-07 2018 | How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE! intermediate SSRF | The content appears to be a title mentioning chaining four vulnerabilities on GitHub Enterprise, from SSRF execution to RCE. The author is identified as 🍊. |
| 2018-04-29 2018 | #BugBounty — How I was able to bypass firewall to get RCE and then went from server shell to get… intermediate | The content is about a bug bounty experience where the author bypassed a firewall to achieve Remote Code Execution (RCE) and gained access to a server shell. The author likely shares details of the process and techniques used in this security testing scenario. |
| 2017-11-19 2017 | Leading the Blind to Light! - A Chain to RCE advanced 5 min read | Writeup detailing a Remote Code Execution chain on Oracle E-Business Suite. The exploit begins with an authentication bypass, leading to blind XXE and information disclosure. This disclosure helps identify an internal endpoint, which through further fuzzing, reveals an SQL injection vulnerability. By re-enabling `xp_cmdshell` via SQL injection, the attacker achieves command execution with administrator privileges. → blog.zsec.uk |