PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How to find RCE: A list of pathways and detection methods

bugcrowd.com | blog | #bug-bounty | #rce | #exploitation | #detection | #command-injection | #oob
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A field guide to finding RCE: command injection in OS exec sinks like system, subprocess, and child_process, detected via output changes, time delays, and out-of-band callbacks to collaborator servers.
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
tool · github.com
node2shell-scanner: High-Fidelity Remote Detection Tool for Node.js Brotli OOB Write (CVE-2026-111497)
Provides defenders and security teams with a safe, non-destructive, and high-fidelity method to scan large attack surfaces and confirm Node.js exposure to the critical Brotli decoder flaw.
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · lab.ctbb.show
Write Path Traversal to a RCE Art Department
# Write Path Traversal to a RCE Art Department ~/authors/fsi - profile fsi * * * Diyan Apostolov Nov 28, 2025 CriticalThinking Research members are treated as artists thus here is my small and...
blog · portswigger.net
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you're respons
blog · xbow.com
A Vulnerability Is a Hypothesis. An Exploit Is the Proof.
Every security team runs on one scarce resource: the attention of those who can fix things. Only an exploitable bug is worth interrupting an engineer for.
Back