rce
Remote Code Execution: running arbitrary code on the target server.
Quick answer
What is rce?
Remote Code Execution: running arbitrary code on the target server.
Articles
8
Beginner
1
Intermediate
3
Advanced
4
Beginner level
1Intermediate level
3File Upload — extension, content-type and magic bytes bypasses
10 bypasses to upload webshells: double extension, null byte, content-type spoof, magic bytes, polyglots, race conditions and path traversal abuse.
SQL Injection — complete methodology with time-based, UNION and RCE
Detection via isomorphic queries, time-based payloads for 4 engines, escalation to RCE (xp_cmdshell, INTO OUTFILE, UDFs) and cross-field bypasses.
Command Injection — bypasses with spaces, encoding and backticks
Command injection in endpoints that pass input to the shell. Filter bypasses: ${IFS}, $@, ;|&, encoded null bytes, output redirection to a file.
Advanced level
4Headless browsers — SSRF and RCE in endpoints that render URLs
Endpoints that accept URLs for screenshots/PDF (Puppeteer, Playwright, wkhtmltopdf) are an SSRF goldmine: cloud metadata, file://, gopher://, JS injection with XSS-to-RCE in the chromium sandbox.
RCE in a Python sandbox — from the bot editor to the server shell
An AI platform's Python sandbox didn't block os.popen(). Two lines of Python to run system commands, read environment variables and fingerprint the runtime.
PHP class pollution — the PHP equivalent of Prototype Pollution
How PHP class pollution (via recursive merge / object instantiation with user input) produces deserialization-like RCE in Laravel, Symfony, WordPress apps without needing gadget chains.
SSTI — Server-Side Template Injection in Jinja2, Twig, Velocity and Freemarker
Detection with polyglots, engine identification, escalation to RCE in Jinja2/Python, Twig/PHP, Velocity/Java. Patterns where user input reaches templates.
Practice rce with real labs
Apply the techniques in safe environments based on real bug bounty reports.
hunters training
labs from real hacks
completions
paid out for these bugs
The checklist I run on every new target
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
Stop reading about bugs and start hunting them
Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime