ToolPublished 22 Sep 2026

The finding said RCE. The second tester asked one question and the ticket died.

Source Reddit NetSec

Mentions 2 CVEs

Mentioned vulnerabilities

Discussion

RCEKit is an open-source toolkit designed to detect and confirm remote code execution (RCE) vulnerabilities during authorized penetration testing and security research. It uses multiple methods to distinguish confirmed RCE from weaker signals or false positives by generating unique tokens and verifying their presence in target responses or out-of-band callbacks. The tool has been tested against real-world CVEs such as Webmin CVE-2019-15107, Apache Struts2 S2-001, and Log4Shell CVE-2021-44228, demonstrating its ability to confirm or classify RCE findings accurately. RCEKit does not report uncertain cases as confirmed, instead assigning them lower confidence tiers. It supports testing via URLs or captured HTTP requests and offers various probing methods, including reflected, eval, time-based, lookup, and deserialization injection techniques. The tool is intended for use only on authorized targets and requires careful configuration due to the high volume of requests it generates.

r/netsec (opens in a new tab)u/No-View33330 points0 comments

When is an RCE finding actually confirmed?
A timing anomaly, a DNS callback, or a reflected response can indicate a potential injection vulnerability. But how do we reliably distinguish these signals from actual code execution?
I’ve been working on a systematic approach to RCE detection and confirmation, focusing on three questions:

- What does each type of evidence actually prove?

- How can we distinguish execution from unrelated behavior or false positives?

- How should a testing tool report cases where execution cannot be confirmed?

I implemented this approach in an open-source toolkit called RCEKit:
https://github.com/kabiri-labs/rcekit

I’m interested in how other pentesters handle the boundary between suspected and confirmed RCE, especially in blind or restricted execution environments.
What evidence do you consider sufficient to confirm RCE, and which edge cases tend to produce misleading results?

Links cited in the discussion

https://github.com/kabiri-labs/rcekit

Impact

The impact of RCEKit itself is to improve the accuracy and reliability of remote code execution vulnerability detection and confirmation during penetration testing and security research. It helps reduce false positives and provides clear evidence of actual code execution, which is critical for prioritizing remediation efforts. There is no indication that RCEKit introduces vulnerabilities or exploits targets beyond authorized testing. The tool aids security professionals in validating RCE findings, which can lead to more effective vulnerability management and mitigation.

Defensive guidance

This entry describes a detection and confirmation toolkit rather than a vulnerability requiring remediation. Users should ensure they have proper authorization before using RCEKit to test targets. The tool's documentation and usage guidelines should be followed carefully to avoid unintended impact. Since this is a security testing tool, no mitigation actions are required beyond responsible and authorized use.

Summary

RCEKit is a Python 3.8+ toolkit with no third-party dependencies that systematically detects and confirms remote code execution vulnerabilities by sending crafted probes to a target and analyzing responses for unique computed values or out-of-band callbacks that prove execution. It differentiates confirmed RCE from weaker signals such as timing anomalies or DNS callbacks that do not conclusively prove code execution. The toolkit has been benchmarked against known CVEs, confirming execution in cases like Webmin OS command injection and Apache Struts2 OGNL expression injection, while marking others as needing review or negative when execution cannot be confirmed. It supports multiple injection methods and can operate from a simple URL or a full captured HTTP request, enumerating injection points and testing various sinks. The tool emphasizes proof over speculation and is designed for authorized testing environments.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 22 Sep 2026, 20:47 UTC

Technical details

References

Community reviews

Related threats