rcekit 3.0.0__tar.gz → 3.0.1__tar.gz

{rcekit-3.0.0 → rcekit-3.0.1}/CHANGELOG.md

@@ -290,6 +290,57 @@ formats, or the template schema.
 
   No version bump -- this is documentation and tests only.
 
+## [3.0.1] — 2026-10-01
+
+### Fixed
+
+- **`reflected` named a shell it had not proved.** One of its probe shapes — a
+  bare `expr a + b` at `--probe-depth full`, whose expected value was the sum
+  alone, matched digit-fenced — reported `executed` under
+  `[reflected/<environment>/...]` against targets where nothing executed a
+  command. Groovy reads `expr 548286 + 675041` as the command expression
+  `expr(548286 + 675041)`: it computes the sum, fails to resolve the method, and
+  echoes the result in its error.
+
+  The tier was never wrong. The target did compute a value reflection cannot
+  forge, and `eval` reaches `executed` on such an endpoint honestly. What was
+  wrong is the **class**: a finding printed under `reflected/unix` asserts a
+  POSIX shell ran the input, and in a report a correct proof filed under the
+  wrong class is worse than a miss.
+
+  Measured against a plain Apache HugeGraph 1.2.0 Gremlin endpoint with every
+  shape mapped (`--confirm-depth every`): 42 probes, `executed=3`, all three
+  that one shape, and 0 of 36 tagged probes confirming. Measured against the
+  same build's ProcessBuilder body, where a real `sh -c` runs: 4 tagged shapes
+  confirm — the canonical `$(( ))` plus `$(echo TAG)` collapse, the backtick
+  `expr`, the `${IFS}` space-free form and the comment-terminated collapse — so
+  removing the shape costs nothing on a genuine shell. The remaining shapes all
+  require the target to place RCEKit's random tags *around* the value it
+  computed, which an expression evaluator handed the payload cannot do.
+
+  The shape is removed rather than repaired: `expr` has no portable string
+  concatenation, so there is no way to bracket its result in a tag without
+  reintroducing the `$(` or the `echo` keyword the shape existed to avoid. The
+  substitution-free coverage it shared is carried by `awk` alone, which is
+  unaffected. A sink that filters `$(`, backticks and `awk` at once is now out
+  of `reflected`'s reach and stays reachable through `time`, `oob` and `file`.
+
+  `--probe-depth quick` never sent the shape, so a `quick` run is unchanged.
+  Two guards hold the invariant over every environment, context and depth: no
+  probe's expected value may be the arithmetic alone, and none may match
+  digit-fenced. Both were run against the restored shape and both fail on it,
+  as does a new bench case whose control runs `reflected` against the same
+  Gremlin endpoint and requires `negative` — with the shape restored it reports
+  `executed=30`.
+
+  One second-order effect worth knowing: the retired shape was also the
+  shortest probe `reflected` built, so the shortest is now 41 characters rather
+  than about 20. A `--max-length` below 41 therefore leaves the method with no
+  probe at all. That fails loudly rather than quietly — the run prints
+  `NOTHING WAS TESTED — this is not a negative result`, names
+  `--max-length` as what removed all 36 probes, and says to relax it or treat
+  the sink as one the probe vocabulary cannot reach.
+
 ## [3.0.0] — 2026-09-30
 
 ### Changed
@@ -2700,6 +2751,7 @@ this file and have not been restated here.
 
 
 [Unreleased]: https://github.com/kabiri-labs/rcekit/compare/v2.36.0...HEAD
+[3.0.1]: https://github.com/kabiri-labs/rcekit/compare/v3.0.0...v3.0.1
 [3.0.0]: https://github.com/kabiri-labs/rcekit/compare/v2.45.7...v3.0.0
 [2.45.7]: https://github.com/kabiri-labs/rcekit/compare/v2.45.6...v2.45.7
 [2.45.6]: https://github.com/kabiri-labs/rcekit/compare/v2.45.5...v2.45.6

{rcekit-3.0.0 → rcekit-3.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rcekit
-Version: 3.0.0
+Version: 3.0.1
 Summary: RCE detection & confirmation toolkit for authorised penetration testing
 Author: Ahmad Kabiri
 License-Expression: MIT
@@ -24,7 +24,7 @@ Dynamic: license-file
 
 **`executed` means the target executed the input. `negative` means the probes reached it.**
 
-**Version 3.0.0** · MIT · Python 3.8+ · zero third-party dependencies
+**Version 3.0.1** · MIT · Python 3.8+ · zero third-party dependencies
 
 RCEKit is an **RCE detection & confirmation toolkit** for authorised penetration
 testing, red teaming and security research. Point it at a target you are allowed
@@ -73,25 +73,15 @@ method could reach in principle.
 **Bench case** says whether [`tests/bench/`](tests/bench/) reproduces the row —
 bringing the target up under Docker and checking the verdict **and** its negative
 control. All 11 rows do; `python tests/bench/runner.py --all` was last green at
-**3.0.0** (2026-09-30), 9/9 cases in 55m50s. That is a point-in-time claim, not
-a continuous one: the benchmark runs on a cadence, not on every change. A row
-reading *as a control* is reproduced by the control half of another row's case,
-which is the half that describes it.
-
-3.0.0 renamed the verdict every case expects, so every one of the 9 was re-run
-under the new names and all 9 passed — the `Verdict` column above is what that
-run reported, not a rename applied to an older result.
-
-What each run's **control** half reported is not in this table, and two of them
-are the reason the run was worth doing. The full 9 rows, controls included, are
-in [`tests/bench/README.md`](tests/bench/README.md#status); the two rows here
-reading *as a control* are the `time` halves of the Webmin and OpenTSDB cases,
-so their `timing-sink` is a control result shown in the `Verdict` column.
-
-Those two are the ones worth having: on a Webmin 1.910 and an OpenTSDB 2.4.1
-that are genuinely vulnerable, `time` reaches its own proven tier and still does
-not reach `executed`. That is the tier ceiling holding against real software
-rather than against a fixture.
+**3.0.1** (2026-10-01), 10/10 cases in 55m48s. That is a point-in-time claim:
+the benchmark runs on a cadence, not on every change.
+
+The controls are not in this table and two of them are the point. On a Webmin
+1.910 and an OpenTSDB 2.4.1 that are genuinely vulnerable, `time` reaches its
+own proven tier and still does not reach `executed` — a ceiling holding against
+real software rather than against a fixture. Those two are the rows reading *as
+a control* above. The full 10, controls included, are in
+[`tests/bench/README.md`](tests/bench/README.md#status).
 
 **Advisory** is empty where the verdict does not depend on the patch. Both
 HugeGraph rows and the fastjson row are `—` deliberately: HugeGraph 1.3.0 answers
@@ -195,11 +185,55 @@ rcekit --acknowledge-consent \
 
 ```
 [detect] methods: reflected, eval
-[detect] sent 13 probes (13 result(s)): executed=4, negative=9
+[detect] sent 1430 probes (1430 result(s)): executed=17, negative=1413
 
-[detect] EXECUTED (4):
-  [reflected/unix/raw] ; echo RKYZRIP$((540141+314681))RKFWVFS$(echo RKBWOOC)RKYZRIP
-      (target computed 'RKYZRIP854822RKFWVFSRKBWOOCRKYZRIP' — random operands, absent from control)
+[detect] EXECUTED (17):
+  [reflected/unix/raw] | awk 'BEGIN{print "RKDXCXU" 206334+786088 "RKLMVXZ"}'
+      (target computed 'RKDXCXU992422RKLMVXZ' (random operands, absent from control))
+```
+
+**That is 1430 requests against this target.** With no `--environments`, RCEKit
+sweeps every sink dialect it knows — POSIX, `cmd.exe`, PowerShell, and the
+language runtimes that reach a shell — because which one is behind the parameter
+is the thing you do not know yet. 17 of them computed the value, which is one
+sink answering in seventeen dialects, not seventeen findings.
+
+The target moves the number: at the default `--confirm-depth first`, a carrier
+stops once it confirms, so a sink that answers sends **fewer** probes than one
+that never does. The same command against an endpoint that only echoes sent
+1684.
+
+Narrow it when you already know something. Against the same target, the same
+command plus `--environments unix` sends 177 requests; adding `--contexts raw`
+as well sends 32.
+
+Every probe count in this quick start was measured at **3.0.0**, and like the
+benchmark's they are point-in-time rather than constants. 3.0.1 retired a probe
+shape, which took a measured 44 requests per point off a comparable sink —
+without costing a single confirmation, which is why the `executed` counts are
+the figures least likely to have moved.
+
+**`--max-payloads` means two different things, and both will surprise you once.**
+
+On a single point — a `--verify-url`, or `-r` without `--auto-params` — it is
+one allowance **shared by every method you selected**. `--methods
+reflected,deser --max-payloads 5` sends 5 probes in total, and `reflected` can
+spend all five: `deser` then never runs, and the run reports nothing about
+deserialization because it never asked. That is the shape to watch, because a
+budget set for politeness quietly becomes a coverage gap.
+
+Under `--auto-params` it is the opposite — a budget *per injection point, per
+question*, where execution, lookup and deserialization are three questions, and
+each point's payload-free control sits outside it. Measured: `--max-payloads 5`
+across 3 points and 2 questions sent 30 probes, not 5.
+
+So read the cost line. It prints before any traffic and names the multiplier it
+is applying:
+
+```
+[detect] cost: 3 points x ~10 probes (capped by --max-payloads 5 per question,
+         2 question(s) asked) = at least 36 requests (each point carries its
+         own payload-free control)
 ```
 
 ### From a captured request — the shape most real targets have
@@ -216,13 +250,14 @@ rcekit --acknowledge-consent \
 ```
 
 ```
-[detect] sent 4 probes (4 result(s)): executed=3, negative=1
-
-[detect] EXECUTED (3):
-  [reflected/unix/raw] ; echo RKHWNHK$((114157+752773))RKXGFIH$(echo RKHSEIF)RKHWNHK
-      (target computed 'RKHWNHK866930RKXGFIHRKHSEIFRKHWNHK' — random operands, absent from control)
+[detect] EXECUTED (17):
+  [reflected/unix/raw] | awk 'BEGIN{print "RKXJTON" 570247+922635 "RKJCVJT"}'
+      (target computed 'RKXJTON1492882RKJCVJT' (random operands, absent from control))
 ```
 
+Same corpus, so the same scale as above — what changes is that the session
+cookie, the content type and the body go with every probe.
+
 The method, path, headers, body and cookies are reused as captured, and each
 value is encoded for the context it lands in — a JSON leaf, a form field and a
 cookie are not escaped the same way. Drop `-p` and mark the spot with `FUZZ` or
@@ -238,12 +273,17 @@ knowing before concluding a target is clean.
 ```bash
 rcekit --acknowledge-consent \
   -r search.req --auto-params all --point-order thorough \
-  --methods reflected,eval,time,lookup,deser \
+  --methods reflected,eval,time,oob,lookup,deser,boolean \
   --oob-host oob.yourdomain.example --listen-dns-port 53 \
   --verify-active-risk stateful --probe-depth full \
   --detect-json findings.json
 ```
 
+That is **7 of the 9 methods**. The two left out are the ones that need a path
+only you can supply: `file` wants somewhere writable the target also serves
+(`--file-write-path` + `--file-read-url`), and `write` wants the URL your own
+upload lands at (`--write-url-template`). Both are below.
+
 ```
 [verify] loaded request from search.req: enumerating 4 injection point(s)
 [detect] enumerating 4 injection point(s) x 3 method(s)
@@ -259,7 +299,7 @@ What each flag opens up:
 | `--auto-params all` | every query value, JSON leaf, form field, multipart part, cookie and header, instead of one named field |
 | `--point-order thorough` | every non-hop-by-hop header, not just the high-yield ones |
 | `--methods ...,lookup,deser` | expression-lookup and deserialization sinks, which the shell-shaped methods cannot reach |
-| `--oob-host` | a callback host for the blind methods. Needs a domain delegated to you; port 53 needs root |
+| `--oob-host` | a callback host for the blind methods. An IP the target can reach serves `oob`; `lookup` and `deser`'s gadget can only put a token in a DNS label, so both need a domain delegated to you, and port 53 needs root |
 | `--verify-active-risk stateful` | the top rung — adds the probe shapes that make the target fetch from an address RCEKit did not choose |
 | `--probe-depth full` | every break-out shape per sink, not the cheap ones only |
 | `--detect-json` | the same verdicts as machine-readable JSON |
@@ -271,6 +311,74 @@ target, not for production.
 
 No external infrastructure, no config file.
 
+### When nothing comes back
+
+The most common way to call a target clean when it is not: `reflected` and
+`eval` need the computed value rendered somewhere, and a sink that returns no
+output has nowhere to render it. A `negative` from those two is not an answer
+about the sink, only about the channel.
+
+Two methods still reach **`executed`** there, and which one you can use depends
+on what you have:
+
+```bash
+# The target can reach something of yours. An address is enough: `oob` carries
+# the token in a URL path, so the HTTP channel alone can reach `executed`.
+rcekit --acknowledge-consent \
+  --verify-url "https://target.example/render?q=FUZZ" \
+  --methods oob --oob-host 203.0.113.9 \
+  --verify-active-risk intrusive
+```
+
+Give it a **delegated name** and `--listen-dns-port 53` instead when you have
+them, and the DNS shapes come alive too — those often cross egress filtering
+that blocks outbound HTTP. They cannot work off an address: a resolver reaches
+the authority for a name on port 53 only, and RCEKit says so rather than sending
+probes that silently never fire. The benchmark's OpenTSDB case runs the plain
+address form and reaches `executed`.
+
+```bash
+# No egress at all — but something writable you can also read back.
+# Writes a random token, fetches it, and prints a cleanup line per finding.
+rcekit --acknowledge-consent \
+  -r search.req -p q \
+  --methods file \
+  --file-write-path /var/www/html/uploads \
+  --file-read-url "https://target.example/uploads/{name}" \
+  --verify-active-risk stateful
+```
+
+The read-back does not have to be a web root. `--file-read-url` takes `{name}`
+for a handler that wants a filename, and `{path}` or `{path_enc}` for one that
+takes the whole server-side path — so a writable `/tmp` plus an LFI parameter,
+a download handler or an export endpoint is enough.
+
+With neither, `--methods time` still measures a controlled delay series — but it
+reports `timing-sink`, which proves the target honoured a delay and not that a
+shell ran. [Blind targets](docs/guide.md#blind-targets) and
+[No-egress targets](docs/guide.md#no-egress-targets) work each of these through.
+
+### When your own request stores the file
+
+An upload, or a `PUT` the server accepts. Nothing in the response is computed,
+so `reflected` and `eval` report `negative` against a target that is fully
+exploitable. `write` inverts the question: it stores a one-liner that *computes*
+a product, fetches the file back, and reads which of three things happened —
+the product (`executed`), the source verbatim (`file-write`, an arbitrary write
+that is served but not interpreted), or neither.
+
+```bash
+rcekit --acknowledge-consent \
+  --verify-url "https://target.example/probe.jsp/" \
+  --verify-method PUT --verify-data FUZZ --verify-body-location raw \
+  --methods write --write-url-template "https://target.example/probe.jsp" \
+  --verify-active-risk stateful
+```
+
+That is the CVE-2017-12615 shape, and it is one of the benchmark's cases.
+[Upload and write-primitive targets](docs/guide.md#upload-and-write-primitive-targets)
+covers the others.
+
 **Don't take the GIFs on trust** — [reproduce them yourself](docs/verify-it-yourself.md)
 against dockerised Webmin and Struts2 targets in about five minutes.
 
@@ -442,15 +550,10 @@ python rcekit.py --acknowledge-consent -r request.txt -p host --methods reflecte
 A tool reports what it found. RCEKit also reports **what it refused to believe** —
 `inconclusive` is a verdict of its own, for anything it cannot attribute to
 execution: evidence that showed up in the payload-free control too, and equally
-a measurement the run never finished gathering:
-
-```
-[detect] methods: reflected, eval
-[detect] sent 13 probes (13 result(s)): executed=0, inconclusive=2, negative=11
-```
+a measurement the run never finished gathering. Either would have been someone
+else's finding.
 
-Those two would have been someone else's finding. Five mechanisms produce that
-verdict, and they run on every confirmation:
+Five mechanisms produce that verdict, and they run on every confirmation:
 
 - **A payload-free control request.** Evidence must be present *with* the payload
   and absent *without* it. Anything in both is `inconclusive`, not a finding.
@@ -508,15 +611,40 @@ exploit the database.
 
 ## Find your situation
 
-Each row is a worked example in the [field guide](docs/guide.md) — the command,
-what it sends, and how to read what comes back.
+Two different questions, and they are worth keeping apart. The first is **which
+method** — what the target lets you observe decides that, and it decides how
+strong an answer you can get. The second is **getting the payload to land**,
+which is the same method fighting a filter, a quote or an encoding.
+
+### Which method, and what it needs from you
+
+| What you can observe | Method | You must already have | Reaches |
+|---|---|---|---|
+| Output comes back in the response | `reflected`, `eval` | nothing | **`executed`** |
+| Nothing comes back; the target has egress | `oob` | a listener it can reach — a bare IP is enough. The DNS shapes also want a delegated name and port 53 | **`executed`** |
+| Nothing comes back, no egress; somewhere writable you can also read back | `file` | the write path, and any URL that returns it — a web root, an LFI parameter, a download or export handler | **`executed`** |
+| Your own request stores a file | `write` | the URL the file lands at | **`executed`** |
+| Nothing comes back and none of the above | `time` | nothing | `timing-sink` |
+| The sink interpolates `${…}` rather than shelling out | `lookup` | a delegated domain | `lookup-sink` |
+| The parameter carries a serialized object | `deser` | nothing for the shape fingerprint; the DNS gadget needs a delegated name and a listener | `needs-review`, or `deserialization-sink` with the gadget |
+| The sink evaluates but renders nothing of it | `boolean` | nothing; `OR` shapes need `stateful` | `evaluation-sink` |
+
+Only the first four reach **`executed`**. `timing-sink`, `lookup-sink`,
+`evaluation-sink` and `deserialization-sink` are proven findings about something
+else. `needs-review` is the exception: it is the parser fingerprint `deser`
+reads when it has no gadget to fire, a real candidate and **not proof** — review
+it by hand rather than reporting it. [What a verdict
+means](#what-a-verdict-means) spells each one out,
+[Choosing methods](docs/guide.md#choosing-methods) has the costs, and the rows
+below have the worked commands.
+
+### Getting the payload to land
 
 | Situation | Go to |
 |---|---|
 | I have a URL and a parameter | [Point at a URL](docs/guide.md#point-at-a-url) |
 | I have a request saved from Burp | [Point at a captured request](docs/guide.md#point-at-a-captured-request) |
 | The app is JSON / the payload keeps getting mangled | [Landing the payload intact](docs/guide.md#landing-the-payload-intact) |
-| I don't know which class it is | [Choosing methods](docs/guide.md#choosing-methods) |
 | The sink strips `;` | [When the sink filters separators](docs/guide.md#when-the-sink-filters-separators) |
 | My input lands inside `'quotes'` | [Injecting inside quotes](docs/guide.md#injecting-inside-quotes) |
 | The sink runs my input as the whole command | [Whole-command sinks](docs/guide.md#whole-command-sinks) |

{rcekit-3.0.0 → rcekit-3.0.1}/README.md

@@ -2,7 +2,7 @@
 
 **`executed` means the target executed the input. `negative` means the probes reached it.**
 
-**Version 3.0.0** · MIT · Python 3.8+ · zero third-party dependencies
+**Version 3.0.1** · MIT · Python 3.8+ · zero third-party dependencies
 
 RCEKit is an **RCE detection & confirmation toolkit** for authorised penetration
 testing, red teaming and security research. Point it at a target you are allowed
@@ -51,25 +51,15 @@ method could reach in principle.
 **Bench case** says whether [`tests/bench/`](tests/bench/) reproduces the row —
 bringing the target up under Docker and checking the verdict **and** its negative
 control. All 11 rows do; `python tests/bench/runner.py --all` was last green at
-**3.0.0** (2026-09-30), 9/9 cases in 55m50s. That is a point-in-time claim, not
-a continuous one: the benchmark runs on a cadence, not on every change. A row
-reading *as a control* is reproduced by the control half of another row's case,
-which is the half that describes it.
-
-3.0.0 renamed the verdict every case expects, so every one of the 9 was re-run
-under the new names and all 9 passed — the `Verdict` column above is what that
-run reported, not a rename applied to an older result.
-
-What each run's **control** half reported is not in this table, and two of them
-are the reason the run was worth doing. The full 9 rows, controls included, are
-in [`tests/bench/README.md`](tests/bench/README.md#status); the two rows here
-reading *as a control* are the `time` halves of the Webmin and OpenTSDB cases,
-so their `timing-sink` is a control result shown in the `Verdict` column.
-
-Those two are the ones worth having: on a Webmin 1.910 and an OpenTSDB 2.4.1
-that are genuinely vulnerable, `time` reaches its own proven tier and still does
-not reach `executed`. That is the tier ceiling holding against real software
-rather than against a fixture.
+**3.0.1** (2026-10-01), 10/10 cases in 55m48s. That is a point-in-time claim:
+the benchmark runs on a cadence, not on every change.
+
+The controls are not in this table and two of them are the point. On a Webmin
+1.910 and an OpenTSDB 2.4.1 that are genuinely vulnerable, `time` reaches its
+own proven tier and still does not reach `executed` — a ceiling holding against
+real software rather than against a fixture. Those two are the rows reading *as
+a control* above. The full 10, controls included, are in
+[`tests/bench/README.md`](tests/bench/README.md#status).
 
 **Advisory** is empty where the verdict does not depend on the patch. Both
 HugeGraph rows and the fastjson row are `—` deliberately: HugeGraph 1.3.0 answers
@@ -173,11 +163,55 @@ rcekit --acknowledge-consent \
 
 ```
 [detect] methods: reflected, eval
-[detect] sent 13 probes (13 result(s)): executed=4, negative=9
+[detect] sent 1430 probes (1430 result(s)): executed=17, negative=1413
 
-[detect] EXECUTED (4):
-  [reflected/unix/raw] ; echo RKYZRIP$((540141+314681))RKFWVFS$(echo RKBWOOC)RKYZRIP
-      (target computed 'RKYZRIP854822RKFWVFSRKBWOOCRKYZRIP' — random operands, absent from control)
+[detect] EXECUTED (17):
+  [reflected/unix/raw] | awk 'BEGIN{print "RKDXCXU" 206334+786088 "RKLMVXZ"}'
+      (target computed 'RKDXCXU992422RKLMVXZ' (random operands, absent from control))
+```
+
+**That is 1430 requests against this target.** With no `--environments`, RCEKit
+sweeps every sink dialect it knows — POSIX, `cmd.exe`, PowerShell, and the
+language runtimes that reach a shell — because which one is behind the parameter
+is the thing you do not know yet. 17 of them computed the value, which is one
+sink answering in seventeen dialects, not seventeen findings.
+
+The target moves the number: at the default `--confirm-depth first`, a carrier
+stops once it confirms, so a sink that answers sends **fewer** probes than one
+that never does. The same command against an endpoint that only echoes sent
+1684.
+
+Narrow it when you already know something. Against the same target, the same
+command plus `--environments unix` sends 177 requests; adding `--contexts raw`
+as well sends 32.
+
+Every probe count in this quick start was measured at **3.0.0**, and like the
+benchmark's they are point-in-time rather than constants. 3.0.1 retired a probe
+shape, which took a measured 44 requests per point off a comparable sink —
+without costing a single confirmation, which is why the `executed` counts are
+the figures least likely to have moved.
+
+**`--max-payloads` means two different things, and both will surprise you once.**
+
+On a single point — a `--verify-url`, or `-r` without `--auto-params` — it is
+one allowance **shared by every method you selected**. `--methods
+reflected,deser --max-payloads 5` sends 5 probes in total, and `reflected` can
+spend all five: `deser` then never runs, and the run reports nothing about
+deserialization because it never asked. That is the shape to watch, because a
+budget set for politeness quietly becomes a coverage gap.
+
+Under `--auto-params` it is the opposite — a budget *per injection point, per
+question*, where execution, lookup and deserialization are three questions, and
+each point's payload-free control sits outside it. Measured: `--max-payloads 5`
+across 3 points and 2 questions sent 30 probes, not 5.
+
+So read the cost line. It prints before any traffic and names the multiplier it
+is applying:
+
+```
+[detect] cost: 3 points x ~10 probes (capped by --max-payloads 5 per question,
+         2 question(s) asked) = at least 36 requests (each point carries its
+         own payload-free control)
 ```
 
 ### From a captured request — the shape most real targets have
@@ -194,13 +228,14 @@ rcekit --acknowledge-consent \
 ```
 
 ```
-[detect] sent 4 probes (4 result(s)): executed=3, negative=1
-
-[detect] EXECUTED (3):
-  [reflected/unix/raw] ; echo RKHWNHK$((114157+752773))RKXGFIH$(echo RKHSEIF)RKHWNHK
-      (target computed 'RKHWNHK866930RKXGFIHRKHSEIFRKHWNHK' — random operands, absent from control)
+[detect] EXECUTED (17):
+  [reflected/unix/raw] | awk 'BEGIN{print "RKXJTON" 570247+922635 "RKJCVJT"}'
+      (target computed 'RKXJTON1492882RKJCVJT' (random operands, absent from control))
 ```
 
+Same corpus, so the same scale as above — what changes is that the session
+cookie, the content type and the body go with every probe.
+
 The method, path, headers, body and cookies are reused as captured, and each
 value is encoded for the context it lands in — a JSON leaf, a form field and a
 cookie are not escaped the same way. Drop `-p` and mark the spot with `FUZZ` or
@@ -216,12 +251,17 @@ knowing before concluding a target is clean.
 ```bash
 rcekit --acknowledge-consent \
   -r search.req --auto-params all --point-order thorough \
-  --methods reflected,eval,time,lookup,deser \
+  --methods reflected,eval,time,oob,lookup,deser,boolean \
   --oob-host oob.yourdomain.example --listen-dns-port 53 \
   --verify-active-risk stateful --probe-depth full \
   --detect-json findings.json
 ```
 
+That is **7 of the 9 methods**. The two left out are the ones that need a path
+only you can supply: `file` wants somewhere writable the target also serves
+(`--file-write-path` + `--file-read-url`), and `write` wants the URL your own
+upload lands at (`--write-url-template`). Both are below.
+
 ```
 [verify] loaded request from search.req: enumerating 4 injection point(s)
 [detect] enumerating 4 injection point(s) x 3 method(s)
@@ -237,7 +277,7 @@ What each flag opens up:
 | `--auto-params all` | every query value, JSON leaf, form field, multipart part, cookie and header, instead of one named field |
 | `--point-order thorough` | every non-hop-by-hop header, not just the high-yield ones |
 | `--methods ...,lookup,deser` | expression-lookup and deserialization sinks, which the shell-shaped methods cannot reach |
-| `--oob-host` | a callback host for the blind methods. Needs a domain delegated to you; port 53 needs root |
+| `--oob-host` | a callback host for the blind methods. An IP the target can reach serves `oob`; `lookup` and `deser`'s gadget can only put a token in a DNS label, so both need a domain delegated to you, and port 53 needs root |
 | `--verify-active-risk stateful` | the top rung — adds the probe shapes that make the target fetch from an address RCEKit did not choose |
 | `--probe-depth full` | every break-out shape per sink, not the cheap ones only |
 | `--detect-json` | the same verdicts as machine-readable JSON |
@@ -249,6 +289,74 @@ target, not for production.
 
 No external infrastructure, no config file.
 
+### When nothing comes back
+
+The most common way to call a target clean when it is not: `reflected` and
+`eval` need the computed value rendered somewhere, and a sink that returns no
+output has nowhere to render it. A `negative` from those two is not an answer
+about the sink, only about the channel.
+
+Two methods still reach **`executed`** there, and which one you can use depends
+on what you have:
+
+```bash
+# The target can reach something of yours. An address is enough: `oob` carries
+# the token in a URL path, so the HTTP channel alone can reach `executed`.
+rcekit --acknowledge-consent \
+  --verify-url "https://target.example/render?q=FUZZ" \
+  --methods oob --oob-host 203.0.113.9 \
+  --verify-active-risk intrusive
+```
+
+Give it a **delegated name** and `--listen-dns-port 53` instead when you have
+them, and the DNS shapes come alive too — those often cross egress filtering
+that blocks outbound HTTP. They cannot work off an address: a resolver reaches
+the authority for a name on port 53 only, and RCEKit says so rather than sending
+probes that silently never fire. The benchmark's OpenTSDB case runs the plain
+address form and reaches `executed`.
+
+```bash
+# No egress at all — but something writable you can also read back.
+# Writes a random token, fetches it, and prints a cleanup line per finding.
+rcekit --acknowledge-consent \
+  -r search.req -p q \
+  --methods file \
+  --file-write-path /var/www/html/uploads \
+  --file-read-url "https://target.example/uploads/{name}" \
+  --verify-active-risk stateful
+```
+
+The read-back does not have to be a web root. `--file-read-url` takes `{name}`
+for a handler that wants a filename, and `{path}` or `{path_enc}` for one that
+takes the whole server-side path — so a writable `/tmp` plus an LFI parameter,
+a download handler or an export endpoint is enough.
+
+With neither, `--methods time` still measures a controlled delay series — but it
+reports `timing-sink`, which proves the target honoured a delay and not that a
+shell ran. [Blind targets](docs/guide.md#blind-targets) and
+[No-egress targets](docs/guide.md#no-egress-targets) work each of these through.
+
+### When your own request stores the file
+
+An upload, or a `PUT` the server accepts. Nothing in the response is computed,
+so `reflected` and `eval` report `negative` against a target that is fully
+exploitable. `write` inverts the question: it stores a one-liner that *computes*
+a product, fetches the file back, and reads which of three things happened —
+the product (`executed`), the source verbatim (`file-write`, an arbitrary write
+that is served but not interpreted), or neither.
+
+```bash
+rcekit --acknowledge-consent \
+  --verify-url "https://target.example/probe.jsp/" \
+  --verify-method PUT --verify-data FUZZ --verify-body-location raw \
+  --methods write --write-url-template "https://target.example/probe.jsp" \
+  --verify-active-risk stateful
+```
+
+That is the CVE-2017-12615 shape, and it is one of the benchmark's cases.
+[Upload and write-primitive targets](docs/guide.md#upload-and-write-primitive-targets)
+covers the others.
+
 **Don't take the GIFs on trust** — [reproduce them yourself](docs/verify-it-yourself.md)
 against dockerised Webmin and Struts2 targets in about five minutes.
 
@@ -420,15 +528,10 @@ python rcekit.py --acknowledge-consent -r request.txt -p host --methods reflecte
 A tool reports what it found. RCEKit also reports **what it refused to believe** —
 `inconclusive` is a verdict of its own, for anything it cannot attribute to
 execution: evidence that showed up in the payload-free control too, and equally
-a measurement the run never finished gathering:
-
-```
-[detect] methods: reflected, eval
-[detect] sent 13 probes (13 result(s)): executed=0, inconclusive=2, negative=11
-```
+a measurement the run never finished gathering. Either would have been someone
+else's finding.
 
-Those two would have been someone else's finding. Five mechanisms produce that
-verdict, and they run on every confirmation:
+Five mechanisms produce that verdict, and they run on every confirmation:
 
 - **A payload-free control request.** Evidence must be present *with* the payload
   and absent *without* it. Anything in both is `inconclusive`, not a finding.
@@ -486,15 +589,40 @@ exploit the database.
 
 ## Find your situation
 
-Each row is a worked example in the [field guide](docs/guide.md) — the command,
-what it sends, and how to read what comes back.
+Two different questions, and they are worth keeping apart. The first is **which
+method** — what the target lets you observe decides that, and it decides how
+strong an answer you can get. The second is **getting the payload to land**,
+which is the same method fighting a filter, a quote or an encoding.
+
+### Which method, and what it needs from you
+
+| What you can observe | Method | You must already have | Reaches |
+|---|---|---|---|
+| Output comes back in the response | `reflected`, `eval` | nothing | **`executed`** |
+| Nothing comes back; the target has egress | `oob` | a listener it can reach — a bare IP is enough. The DNS shapes also want a delegated name and port 53 | **`executed`** |
+| Nothing comes back, no egress; somewhere writable you can also read back | `file` | the write path, and any URL that returns it — a web root, an LFI parameter, a download or export handler | **`executed`** |
+| Your own request stores a file | `write` | the URL the file lands at | **`executed`** |
+| Nothing comes back and none of the above | `time` | nothing | `timing-sink` |
+| The sink interpolates `${…}` rather than shelling out | `lookup` | a delegated domain | `lookup-sink` |
+| The parameter carries a serialized object | `deser` | nothing for the shape fingerprint; the DNS gadget needs a delegated name and a listener | `needs-review`, or `deserialization-sink` with the gadget |
+| The sink evaluates but renders nothing of it | `boolean` | nothing; `OR` shapes need `stateful` | `evaluation-sink` |
+
+Only the first four reach **`executed`**. `timing-sink`, `lookup-sink`,
+`evaluation-sink` and `deserialization-sink` are proven findings about something
+else. `needs-review` is the exception: it is the parser fingerprint `deser`
+reads when it has no gadget to fire, a real candidate and **not proof** — review
+it by hand rather than reporting it. [What a verdict
+means](#what-a-verdict-means) spells each one out,
+[Choosing methods](docs/guide.md#choosing-methods) has the costs, and the rows
+below have the worked commands.
+
+### Getting the payload to land
 
 | Situation | Go to |
 |---|---|
 | I have a URL and a parameter | [Point at a URL](docs/guide.md#point-at-a-url) |
 | I have a request saved from Burp | [Point at a captured request](docs/guide.md#point-at-a-captured-request) |
 | The app is JSON / the payload keeps getting mangled | [Landing the payload intact](docs/guide.md#landing-the-payload-intact) |
-| I don't know which class it is | [Choosing methods](docs/guide.md#choosing-methods) |
 | The sink strips `;` | [When the sink filters separators](docs/guide.md#when-the-sink-filters-separators) |
 | My input lands inside `'quotes'` | [Injecting inside quotes](docs/guide.md#injecting-inside-quotes) |
 | The sink runs my input as the whole command | [Whole-command sinks](docs/guide.md#whole-command-sinks) |