Real world report PoCs

You can read these real world RCE PoCs to better understand how the bug is exploited in the real world scenarios

• How we broke PHP, hacked Pornhub and earned $20,000 by Ruslan Habalov

  • Alert, God-like Write-up, make sure you know what is ROP before clicking, which I don’t =(

• RCE deal to tricky file upload by secgeek

• WordPress SOME bug in plupload.flash.swf leading to RCE in Automatic by Cure53 (cure53)

• Read-Only user can execute arbitraty shell commands on AirOS by 93c08539 (93c08539)

• Remote Code Execution by impage upload! by Raz0r (ru_raz0r)

• Popping a shell on the Oculus developer portal by Bitquark

• Crazy! PornHub RCE AGAIN!!! How I hacked Pornhub for fun and profit – 10,000$ by 5haked

• PayPal Node.js code injection (RCE) by Michael Stepankin

• eBay PHP Parameter Injection lead to RCE

• Yahoo Acqusition RCE

• Command Injection Vulnerability in Hostinger by @alberto__segura

• RCE in Airbnb by Ruby Injection by buerRCE

• RCE in Imgur by Command Line

• RCE in git.imgur.com by abusing out dated software by Orange Tsai

• RCE in Disclosure

• Remote Code Execution by struct2 Yahoo Server

• Command Injection in Yahoo Acquisition

• Paypal RCE

• $50k RCE in JetBrains IDE

• $20k RCE in Jenkin Instance by @nahamsec

• JDWP Remote Code Execution in PayPal by Milan A Solanki

• XXE in OpenID: one bug to rule them all, or how I found a Remote Code Execution flaw affecting Facebook’s servers by Reginaldo Silva

• How I Hacked Facebook, and Found Someone’s Backdoor Script by Orange Tsai

• How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE! by Orange Tsai

• uber.com may RCE by Flask Jinja2 Template Injection by Orange Tsai

• Yahoo Bug Bounty – *.login.yahoo.com Remote Code Execution by Orange Tsai (in Chinese)

• Google App Engine RCE by Ezequiel Pereira

• Exploiting ImageMagick to get RCE on Polyvore (Yahoo Acquisition) by NaHamSec

• Exploting ImageMagick to get RCE on HackerOne by c666a323be94d57

• Trello bug bounty: Access server’s files using ImageTragick by Florian Courtial

• 40k fb rce

• Yahoo Bleed 1

• Yahoo Bleed 2

• Microsoft Apache Solr RCE Velocity Template By Muhammad Khizer Javed

Reference: https://whoami.securitybreached.org/2019/06/03/guide-getting-started-in-bug-bounty-hunting/