hunt-rce

Name: hunt-rce
Availability: InStock
Author: entrovyx

Map user-controlled input to execution sinks and validate RCE via gadget chains.

3|1|Updated Jul 2, 2026

Search Tags:#security #vulnerability #exploitation #pentest #rce #bug bounty

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-rce-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-rce
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-rce
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-rce-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying and validating Remote Code Execution (RCE) vulnerabilities, which are often complex, multi-stage, and require deep knowledge of execution sinks and gadget chains.

Core Features & Use Cases

Execution Context Mapping: Identifies where user-controlled input reaches execution layers like template engines, shell commands, and deserializers.
Gadget Chain Analysis: Provides specific payloads for common RCE primitives including SnakeYAML, SpEL, and path traversal.
Use Case: When auditing an enterprise management console, use this skill to systematically test configuration fields for template injection or command execution, ensuring you can demonstrate impact with a verified out-of-band callback.

Quick Start

Use the hunt-rce skill to analyze the target endpoint for potential template injection and command execution vulnerabilities.

Frequently Asked Questions about hunt-rce

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify and validate Remote Code Execution vulnerabilities during a pentest?▼

To identify RCE vulnerabilities, map user-controlled input to execution sinks like template engines and deserialization pipelines, then apply verified gadget chains to confirm execution via out-of-band callbacks.

How does user-controlled input reach execution sinks in enterprise server products?▼

User-controlled input reaches execution sinks when application configuration fields or endpoint parameters are passed unsanitized to template engines, shell commands, or deserializers, allowing injected payloads to trigger code execution.

What is the best way to test template injection and command execution in management consoles?▼

The best way to test for template injection and command execution is systematically testing configuration fields with specific payloads for common RCE primitives like SpEL and SnakeYAML to demonstrate infrastructure-wide impact.

Can I use gadget chain analysis for cloud-native infrastructure and deserialization pipelines?▼

Yes, you can use gadget chain analysis on cloud-native infrastructure by applying verified gadget chains to deserialization pipelines and file path operations to confirm execution through out-of-band callbacks.

Why does confirming RCE impact require out-of-band callbacks?▼

Confirming RCE impact requires out-of-band callbacks because they provide verified, external proof that the injected payload executed successfully on the target server, demonstrating infrastructure-wide impact without relying on in-band application responses.

What RCE primitives should I target when auditing enterprise server products?▼

When auditing enterprise server products, target RCE primitives including SnakeYAML, SpEL, and path traversal operations by mapping them to execution sinks to validate vulnerabilities.