--- title: "You Don’t Need a 0-Day for RCE: A Real-World Kill Chain" url: https://daily.dev/posts/you-don-t-need-a-0-day-for-rce-a-real-world-kill-chain-dhogdo4ll source_url: https://infosecwriteups.com/you-dont-need-a-0-day-for-rce-a-real-world-kill-chain-e7ec690ba9a4 type: article source: "InfoSec Write-ups" published: 2026-05-10T21:12:24.832Z updated: 2026-05-10T21:12:52.900Z tags: ["security", "osint"] reading_time: 10 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # You Don’t Need a 0-Day for RCE: A Real-World Kill Chain **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 10 min read · 0 upvotes · 0 comments ## Summary A real-world penetration test walkthrough showing how RCE was achieved without any zero-days. The attack chain involved using OSINT tools (Censys, Shodan) to discover the origin IP behind a Cloudflare WAF, bypassing the WAF entirely by connecting directly to the backend, and exploiting an unrestricted file upload endpoint on an IIS/ASP.NET server by uploading an .aspx web shell with a spoofed image Content-Type header. The post also introduces OriginSniper, a Bash script automating origin IP verification, and concludes with remediation advice including authenticated origin pulls, strict firewall rules, and server-side file validation using magic bytes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [You Don't Have to Run an Exploit to Know If You're Vulnerable](https://daily.dev/posts/you-don-t-have-to-run-an-exploit-to-know-if-you-re-vulnerable-ejvt7otyu) · BleepingComputer · 0 upvotes · 0 comments - [The Story of a Perfect Exploit Chain: Six Bugs That Looked Harmless Until They Became Pre-Auth RCE in a Security Appliance](https://daily.dev/posts/the-story-of-a-perfect-exploit-chain-six-bugs-that-looked-harmless-until-they-became-pre-auth-rce-i-jzsrdfm22) · Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#osint](https://daily.dev/tags/osint) [View this post on daily.dev](https://daily.dev/posts/you-don-t-need-a-0-day-for-rce-a-real-world-kill-chain-dhogdo4ll)