Summary
This is your playbook for exploiting exposed infrastructure services that should never face the internet but often do. It walks through unauthenticated Redis (write SSH keys, cron jobs, or webshells), Rsync data exfiltration, PHP-FPM FastCGI RCE, Ghostcat AJP file reads, Hadoop YARN job submission for shells, and H2 Console JNDI injection. Each section gives you detection commands, exploitation steps with actual tooling, and the hardening config that would have stopped you. The port matrix alone is worth having loaded when you're triaging nmap output. These are infrastructure wins, not web app bugs, so you're often root or equivalent once you land the exploit.
Install to Claude Code
npx -y skills add yaklang/hack-skills --skill unauthorized-access-common-services --agent claude-codeInstalls into .claude/skills of the current project.
Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →
Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →Files
SKILL.md
Select a file.
Featured
Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →
