What problem does it solve? Security testers assessing Laravel/PHP applications often produce false positives from generic scanner hits or PHP stack traces, and risk unsafe actions like triggering deserialization gadgets or leaking APP_KEY secrets. This Skill enforces an evidence-gated, authorization-first workflow for Laravel-specific validation. ## Core Features & Use Cases - Framework Fingerprinting: Confirms Laravel version, exposed routes, debug status, and session/file/queue features from responses, static assets, and deployment metadata before any probing. - Evidence-Gated Validation: Uses vendor advisories and self-owned debug canaries for low-impact verification, rejecting scanner findings and generic PHP errors as proof. - Safe Routing & Stop Conditions: Halts on deserialization gadgets, secret usage, or queue commands, and routes upload/session/deserialization findings to specialized skills or CVE methodology. - Use Case: During an authorized engagement, you detect a Laravel debug page on a target. Use this Skill to confirm the framework version, validate configuration boundaries with your own canary, and document evidence without executing chain exploits. ## Quick Start Use hunt-laravel to plan an evidence-gated, authorized validation path for the Laravel target in scope.
