Identifies high-impact security vulnerabilities in Laravel PHP applications.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-laravel
Please help me install this Agent Skill. Skill: hunt-laravel Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-laravel Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-laravel
Laravel applications frequently contain high-impact, framework-specific vulnerabilities that are often missed during standard security assessments, leading to unpatched risks like remote code execution, account takeover, and sensitive credential theft.
Use the hunt-laravel skill to scan the target domain your-target.com for all common Laravel-specific vulnerabilities including debug mode leakage, dashboard exposure, and mass assignment flaws.
High-intent search queries and answers about installing and using this skill.
To test for Laravel security vulnerabilities, you systematically validate framework-specific flaws like debug mode exposure, .env APP_KEY leakage, and mass assignment. This process confirms high-impact misconfigurations unique to Laravel applications during authorized security assessments.
Common Laravel vulnerabilities include Ignition RCE (CVE-2021-3129), unauthorized Telescope or Horizon dashboard access, signed URL bypasses, and Eloquent mass assignment. These framework-specific flaws can lead to remote code execution and account takeover if left unpatched.
You can fingerprint a Laravel application by checking for specific session cookies, analyzing framework-specific error pages, and probing common paths. Confirming the target runs Laravel is the first step before testing for its unique security misconfigurations.
Yes, you can detect Eloquent mass assignment and cookie deserialization flaws by systematically validating common Laravel misconfigurations. Testing these specific vulnerabilities helps identify high-severity findings like account takeover during offensive security engagements.
Yes, Laravel penetration testing explicitly covers .env exposure with APP_KEY leakage and debug mode exposure. Validating these specific framework misconfigurations helps uncover critical risks like sensitive credential theft and remote code execution.
The best way to check for CVE-2021-3129 Ignition RCE is to systematically test the target application for this specific vulnerability alongside other critical Laravel flaws. This confirms if the framework version is exposed to known remote code execution vectors.
ArianHobson333Identify subdomains, ports, endpoints, APIs, and attack surfaces.
uphiagoEnumerate and validate 9+ account takeover attack paths for web applications.
EntroVyxProbe HTTP parameters and headers to detect API security misconfigurations.
netresearchDetect security vulnerabilities in PHP applications and score risks with CVSS v3.1.
