hunt-laravel

# HUNT-LARAVEL — Laravel Specific Vulnerabilities ## Crown Jewel Targets Laravel debug mode enabled in production = instant RCE via Ignition (CVE-2021-3129). **Highest-value findings:** - **Ignition RCE (CVE-2021-3129)** — `APP_DEBUG=true` + Laravel < 8.4.2 → `/_ignition/execute-solution` RCE without auth - **Telescope dashboard** — `/telescope` exposes full request/response logs, DB queries, Redis commands, scheduled jobs, environment variables - **Horizon dashboard** — `/horizon` exposes queue job details, failed jobs with full payloads (may contain API keys, PII) - **Signed URL manipulation** — if `URL::signedRoute` validates wrong params → bypass signed URL → unauthorized actions - **.env exposure** — `APP_KEY` leaked → decrypt all encrypted cookies → forge session → ATO --- ## Phase 1 — Fingerprint Laravel ```bash # Laravel-specific indicators curl -sI https://$TARGET/ | grep -i "laravel_session\|x-powered-by.*php" curl -s https://$TARGET/ | grep -i "laravel\|Illuminate\|csrf-token" # Common Laravel paths for path in /storage /public /resources "/vendor/laravel" "/.env" "/artisan"; do STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$path") [ "$STATUS" != "404" ] && echo "$path: $STATUS" done # Check error page (trigger 404) curl -s "https://$TARGET/definitely-does-not-exist-xyz" | grep -i "laravel\|Whoops\|Ignition\|symfony" ``` --- ## Phase 2 — Debug Mode & Ignition RCE (CVE-2021-3129) ```bash # Step 1: Check if debug mode is enabled (Whoo...