---
id: 1737
title: "My first RCE: a tale of good ideas and good friends"
source_domain: josephthacker.com
source_url: "https://josephthacker.com/hacking/2019/11/29/rce-via-imagetragick.html"
published_at: "2019-11-29T00:00:00Z"
tags: ["bug-bounty", "rce", "methodology", "ssrf"]
phying_url: "https://phying.com/item/1737"
lang: en
---

# My first RCE: a tale of good ideas and good friends

## Summary

Joseph Thacker recounts his first RCE and first critical: spraying SSRF parameter payloads with meg across 600,000+ public bug bounty hosts, catching callbacks on a bare python http.server, then isolating the vulnerable host and parameter with split and grep.

## Intelligence Metadata

- **Sources:** josephthacker.com
- **Published:** 2019-11-29T00:00:00Z
- **Original:** https://josephthacker.com/hacking/2019/11/29/rce-via-imagetragick.html
- **Phying News:** https://phying.com/item/1737