skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

write-path-to-rce

Escalate arbitrary file write to remote code execution via framework path resolution.

11|1|Updated May 4, 2026
Search Tags:#path traversal#red teaming#template injection#remote code execution#arbitrary file write#web framework exploitation#view engine abuse
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill write-path-to-rce
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: write-path-to-rce
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/write-path-to-rce
Command: npx skills add https://github.com/dreadnode/capabilities --skill write-path-to-rce

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill solves the challenge of gaining remote code execution on a target web application when only arbitrary file write access (such as via path traversal or file upload vulnerabilities) is available and direct execution of script files is blocked by server-side filtering.

Core Features & Use Cases

  • Multi-framework support: Provides tailored exploitation workflows for Django, Flask, Express.js, Ruby on Rails, Laravel, and ASP.NET MVC applications.
  • Step-by-step guidance: Walks through confirming write access, identifying the target framework, planting payloads in framework-resolved paths, and triggering execution.
  • Red teaming use case: Enables authorized security testers to escalate low-severity file write vulnerabilities to full system compromise by abusing built-in framework view and autoload resolution logic.

Quick Start

Use this skill to escalate a confirmed arbitrary file write vulnerability on a target running a supported web framework to remote code execution by abusing the framework's view or autoload path resolution.

Frequently Asked Questions about write-path-to-rce

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How can I get remote code execution from an arbitrary file write vulnerability?▼

Remote code execution via arbitrary file write is achieved by planting payloads in framework-resolved filesystem paths, such as view or autoload directories, and triggering execution through normal application request flows without server configuration changes.

Which web frameworks are vulnerable to view engine abuse from arbitrary file writes?▼

Django, Flask, Express.js, Ruby on Rails, Laravel, and ASP.NET MVC applications are vulnerable to view engine abuse and autoload path resolution exploitation when an arbitrary file write condition exists.

How do I escalate a path traversal vulnerability to RCE when executable uploads are blocked?▼

Path traversal vulnerabilities escalate to RCE by writing template or autoload files into framework-resolved paths, bypassing executable upload filters by leveraging the web framework's built-in view resolution logic to trigger payload execution.

Can I execute payloads on a Flask application by writing to template directories?▼

Flask applications are exploitable when payloads are written to framework-resolved view paths, triggering template injection and remote code execution during normal application request flows without requiring direct script execution.

What is the workflow for escalating file write access to code execution during red teaming?▼

The red teaming workflow involves confirming write access, identifying the target web framework, planting payloads in framework-resolved filesystem paths, and triggering execution via normal application request flows.

Does template injection work with Laravel and Ruby on Rails autoload mechanisms?▼

Ruby on Rails and Laravel applications are exploitable by abusing built-in framework autoload and view resolution logic, allowing planted payloads to execute through normal application request flows during authorized red teaming engagements.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
4.5k

IDOR Vulnerability Testing

Identify and exploit IDOR vulnerabilities in web applications.

Community
Advanced
cmndcntrlcybercmndcntrlcyber
3

hunt-ssti

Detect and exploit server-side template injection vulnerabilities across template engines.

Community
Advanced
uphiagouphiago
1.1k

hunt-ssti

Detect server-side template injection vulnerabilities and escalate to remote code execution.

Community
Advanced
langbyyilangbyyi
96

upload-insecure-files

Identify insecure file upload vulnerabilities across accept, store, process, and serve trust boundaries.

Community
Advanced