You Don’t Need a 0-Day for RCE: A Real-World Kill Chain

A real-world penetration test walkthrough showing how RCE was achieved without any zero-days. The attack chain involved using OSINT tools (Censys, Shodan) to discover the origin IP behind a Cloudflare WAF, bypassing the WAF entirely by connecting directly to the backend, and exploiting an unrestricted file upload endpoint on an IIS/ASP.NET server by uploading an .aspx web shell with a spoofed image Content-Type header. The post also introduces OriginSniper, a Bash script automating origin IP verification, and concludes with remediation advice including authenticated origin pulls, strict firewall rules, and server-side file validation using magic bytes.