hunt-laravel

1# HUNT-LARAVEL — Laravel Specific Vulnerabilities
2 
3## Crown Jewel Targets
4 
5Laravel debug mode enabled in production = instant RCE via Ignition (CVE-2021-3129).
6 
7**Highest-value findings:**
8- **Ignition RCE (CVE-2021-3129)** — `APP_DEBUG=true` + Laravel < 8.4.2 → `/_ignition/execute-solution` RCE without auth
9- **Telescope dashboard** — `/telescope` exposes full request/response logs, DB queries, Redis commands, scheduled jobs, environment variables
10- **Horizon dashboard** — `/horizon` exposes queue job details, failed jobs with full payloads (may contain API keys, PII)
11- **Signed URL manipulation** — if `URL::signedRoute` validates wrong params → bypass signed URL → unauthorized actions
12- **.env exposure** — `APP_KEY` leaked → decrypt all encrypted cookies → forge session → ATO
13 
14---
15 
16## Phase 1 — Fingerprint Laravel
17 
18```bash
19# Laravel-specific indicators
20curl -sI https://$TARGET/ | grep -i "laravel_session\|x-powered-by.*php"
21curl -s https://$TARGET/ | grep -i "laravel\|Illuminate\|csrf-token"
22 
23# Common Laravel paths
24for path in /storage /public /resources "/vendor/laravel" "/.env" "/artisan"; do
25  STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
26  [ "$STATUS" != "404" ] && echo "$path: $STATUS"
27done
28 
29# Check error page (trigger 404)
30curl -s "https://$TARGET/definitely-does-not-exist-xyz" | grep -i "laravel\|Whoops\|Ignition\|symfony"
31```
32 
33---
34 
35## Phase 2 — Debug Mode & Ignition RCE (CVE-2021-3129)
36 
37```bash
38…