skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-rce

Map user-controlled input to execution sinks and validate RCE via gadget chains.

3|1|Updated Jul 2, 2026
Search Tags:#security#vulnerability#exploitation#pentest#rce#bug bounty
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-rce-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-rce
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-rce
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-rce-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying and validating Remote Code Execution (RCE) vulnerabilities, which are often complex, multi-stage, and require deep knowledge of execution sinks and gadget chains.

Core Features & Use Cases

  • Execution Context Mapping: Identifies where user-controlled input reaches execution layers like template engines, shell commands, and deserializers.
  • Gadget Chain Analysis: Provides specific payloads for common RCE primitives including SnakeYAML, SpEL, and path traversal.
  • Use Case: When auditing an enterprise management console, use this skill to systematically test configuration fields for template injection or command execution, ensuring you can demonstrate impact with a verified out-of-band callback.

Quick Start

Use the hunt-rce skill to analyze the target endpoint for potential template injection and command execution vulnerabilities.

Frequently Asked Questions about hunt-rce

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify and validate Remote Code Execution vulnerabilities during a pentest?▼

To identify RCE vulnerabilities, map user-controlled input to execution sinks like template engines and deserialization pipelines, then apply verified gadget chains to confirm execution via out-of-band callbacks.

How does user-controlled input reach execution sinks in enterprise server products?▼

User-controlled input reaches execution sinks when application configuration fields or endpoint parameters are passed unsanitized to template engines, shell commands, or deserializers, allowing injected payloads to trigger code execution.

What is the best way to test template injection and command execution in management consoles?▼

The best way to test for template injection and command execution is systematically testing configuration fields with specific payloads for common RCE primitives like SpEL and SnakeYAML to demonstrate infrastructure-wide impact.

Can I use gadget chain analysis for cloud-native infrastructure and deserialization pipelines?▼

Yes, you can use gadget chain analysis on cloud-native infrastructure by applying verified gadget chains to deserialization pipelines and file path operations to confirm execution through out-of-band callbacks.

Why does confirming RCE impact require out-of-band callbacks?▼

Confirming RCE impact requires out-of-band callbacks because they provide verified, external proof that the injected payload executed successfully on the target server, demonstrating infrastructure-wide impact without relying on in-band application responses.

What RCE primitives should I target when auditing enterprise server products?▼

When auditing enterprise server products, target RCE primitives including SnakeYAML, SpEL, and path traversal operations by mapping them to execution sinks to validate vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
LeoWSY-hashblueLeoWSY-hashblue
3

reconnaissance

Aggregate subdomains, ports, endpoints, and APIs into structured inventories.

Community
Intermediate
luongldptitluongldptit

security-bounty-hunter

Identify remotely reachable, bounty-eligible security vulnerabilities in software repositories.

Community
Intermediate
getsentrygetsentry
56

wrdn-code-execution

Trace untrusted input to code-execution sinks across languages and frameworks.

Official
Advanced
AcczdyAcczdy
2

exploiting-prototype-pollution-in-javascript

Detect and test prototype pollution vulnerabilities in JavaScript applications.

Community
Advanced