TLDR Tech / InfoSec
You Don't Need a 0-Day for RCE: A Real-World Kill Chain
A pentester walked through a real-world kill chain against a Cloudflare-protected ASP.NET portal, using OSINT (historical SSL certificates via Censys, favicon hashes, and Google Analytics IDs) to unmask the Origin IP, then routed traffic directly via curl --resolve and Burp host overrides to bypass the WAF entirely. Once on the naked IIS backend, an authenticated avatar upload endpoint accepted a .aspx web shell disguised with Content-Type: image/png, yielding RCE as iis apppool\webapp_worker because validation lived only at the WAF perimeter. Defenders should enforce Authenticated Origin Pulls (mTLS between the WAF and the backend), restrict origin firewall ingress to published WAF IP ranges, and validate uploads on the backend via extension allowlists and magic-byte checks rather than relying on Content-Type or perimeter blocks.
Read the full story