> For the complete documentation index, see [llms.txt](https://syed-muhammad-abdul-karim.gitbook.io/learn-to-hack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://syed-muhammad-abdul-karim.gitbook.io/learn-to-hack/security-bugs/rce-remote-code-execution/real-world-report-pocs.md).

# Real world report PoCs

You can read these real world RCE PoCs to better understand how the bug is exploited in the real world scenarios\ <br>

* [How we broke PHP, hacked Pornhub and earned $20,000](https://www.evonide.com/how-we-broke-php-hacked-pornhub-and-earned-20000-dollar/) by Ruslan Habalov
  * *Alert*, God-like Write-up, make sure you know what is ROP before clicking, which I don’t =(
* [RCE deal to tricky file upload](https://www.secgeek.net/bookfresh-vulnerability/) by secgeek
* [WordPress SOME bug in plupload.flash.swf leading to RCE in Automatic](https://hackerone.com/reports/134738) by Cure53 (cure53)
* [Read-Only user can execute arbitraty shell commands on AirOS](https://hackerone.com/reports/128750) by 93c08539 (93c08539)
* [Remote Code Execution by impage upload!](https://hackerone.com/reports/158148) by Raz0r (ru\_raz0r)
* [Popping a shell on the Oculus developer portal](https://bitquark.co.uk/blog/2014/08/31/popping_a_shell_on_the_oculus_developer_portal) by Bitquark
* [Crazy! PornHub RCE AGAIN!!! How I hacked Pornhub for fun and profit – 10,000$](https://5haked.blogspot.sg/) by 5haked
* [PayPal Node.js code injection (RCE)](http://artsploit.blogspot.hk/2016/08/pprce2.html) by Michael Stepankin
* [eBay PHP Parameter Injection lead to RCE](http://secalert.net/#ebay-rce-ccs)
* [Yahoo Acqusition RCE](https://seanmelia.files.wordpress.com/2016/02/yahoo-remote-code-execution-cms1.pdf)
* [Command Injection Vulnerability in Hostinger](http://elladodelnovato.blogspot.hk/2017/02/command-injection-vulnerability-in.html?spref=tw\&m=1) by @alberto\_\_segura
* [RCE in Airbnb by Ruby Injection](http://buer.haus/2017/03/13/airbnb-ruby-on-rails-string-interpolation-led-to-remote-code-execution/) by buerRCE
* [RCE in Imgur by Command Line](https://hackerone.com/reports/212696)
* [RCE in git.imgur.com by abusing out dated software](https://hackerone.com/reports/206227) by Orange Tsai
* [RCE in Disclosure](https://hackerone.com/reports/213558)
* [Remote Code Execution by struct2 Yahoo Server](https://medium.com/@th3g3nt3l/how-i-got-5500-from-yahoo-for-rce-92fffb7145e6)
* [Command Injection in Yahoo Acquisition](http://samcurry.net/how-i-couldve-taken-over-the-production-server-of-a-yahoo-acquisition-through-command-injection/)
* [Paypal RCE](http://blog.pentestbegins.com/2017/07/21/hacking-into-paypal-server-remote-code-execution-2017/)
* [$50k RCE in JetBrains IDE](http://blog.saynotolinux.com/blog/2016/08/15/jetbrains-ide-remote-code-execution-and-local-file-disclosure-vulnerability-analysis/)
* [$20k RCE in Jenkin Instance](http://nahamsec.com/secure-your-jenkins-instance-or-hackers-will-force-you-to/) by @nahamsec
* [JDWP Remote Code Execution in PayPal](https://www.vulnerability-lab.com/get_content.php?id=1474) by Milan A Solanki
* [XXE in OpenID: one bug to rule them all, or how I found a Remote Code Execution flaw affecting Facebook’s servers](http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution) by Reginaldo Silva
* [How I Hacked Facebook, and Found Someone’s Backdoor Script](http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/) by Orange Tsai
* [How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE!](http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html) by Orange Tsai
* [uber.com may RCE by Flask Jinja2 Template Injection](https://hackerone.com/reports/125980) by Orange Tsai
* [Yahoo Bug Bounty – \*.login.yahoo.com Remote Code Execution](http://blog.orange.tw/2013/11/yahoo-bug-bounty-part-2-loginyahoocom.html) by Orange Tsai (in Chinese)
* [Google App Engine RCE](https://sites.google.com/site/testsitehacking/-36k-google-app-engine-rce) by Ezequiel Pereira
* [Exploiting ImageMagick to get RCE on Polyvore (Yahoo Acquisition)](http://nahamsec.com/exploiting-imagemagick-on-yahoo/) by NaHamSec
* [Exploting ImageMagick to get RCE on HackerOne](https://hackerone.com/reports/135072) by c666a323be94d57
* [Trello bug bounty: Access server’s files using ImageTragick](https://hethical.io/trello-bug-bounty-access-servers-files-using-imagetragick/) by Florian Courtial
* [40k fb rce](https://github.com/ngalongc/bug-bounty-reference/blob/master/4lemon.ru/2017-01-17_facebook_imagetragick_remote_code_execution.html)
* [Yahoo Bleed 1](https://scarybeastsecurity.blogspot.hk/2017/05/bleed-continues-18-byte-file-14k-bounty.html)
* [Yahoo Bleed 2](https://scarybeastsecurity.blogspot.hk/2017/05/bleed-more-powerful-dumping-yahoo.html)
* [Microsoft Apache Solr RCE Velocity Template](https://blog.securitybreached.org/2020/03/31/microsoft-rce-bugbounty/) By Muhammad Khizer Javed

**Reference:**\
<https://whoami.securitybreached.org/2019/06/03/guide-getting-started-in-bug-bounty-hunting/>