react2shell-ultimate

React2Shell Ultimate 扫描器 v2.0 用于 CVE-2025-66478 的专业 Next.js RSC RCE 漏洞扫描器 🎯 概述 React2Shell Ultimate 是一款针对 CVE-2025-66478 的全面漏洞扫描器，该漏洞是一个影响使用 React Server Components RSC 的 Next.js 应用程序的严重远程代码执行 RCE 漏洞。 🆕 v2.0 新特性 2.0 版本带来了重大增强和专业功能： ✨ 增强版上帝模式 - 更高级的利用能力，改进了命令执行 🚀 更好的 WAF 绕过 - 更复杂的规避安全控制的技术 🎨 专业...

CVE-2023-5561-POC-Updated

CVE-2023-5561-POC-Updated This repository contains a modified version of the original Proof-of-Concept PoC for CVE-2023-5561. The original PoC, which can be found here, sends a high volume of requests in parallel, which may trigger Web Application Firewalls WAFs or cause the server to block the...

Log4Shell

CVE-2021-44228: Log4j / Log4Shell Security Research Summary This repository contains all gathered resources we used during our Incident Reponse on CVE-2021-44228 and CVE-2021-45046 aka Log4Shell. Threat Intel Mitigations / Fixes Malware Reports Advisory IOCs / Callback Domains / IP Addresses...

log4j-rce-detect-waf-bypass

Este repositorio no tiene un README...

Imperva_gzip_bypass

Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...

Nextjs_RCE_Exploit_Tool

Next.js RCE Exploit Tool CVE-2025-55182 !CAUTION Descargo de responsabilidad / Disclaimer Esta herramienta está destinada únicamente para investigación de seguridad y fines educativos. El usuario debe asegurarse de tener autorización legal del sistema objetivo antes de realizar pruebas. Está...

FortiWeb-cve-2025-64446-RCE-exploit

FortiWeb CVE-2025-64446 RCE Exploit Professional security research & vulnerability assessment framework Installation · Quick Start · Usage · Architecture · CLI Reference · Disclaimer Overview FortiWeb Research Tool is a Python assessment framework for authorized detection and analysis of...

log4shell-coraza

Log4Shell Security Lab — nginx + Coraza WAF Educational / defensive purpose : this lab contains a deliberately vulnerable app Log4j 2.14.1 and a JNDI exploit kit, ONLY for learning how to detect and block Log4Shell in an isolated environment. Do not deploy to the Internet, do not use to attack...

JNDI-Exploit-1.2-log4shell

JNDI-Exploit-1.2-log4shell Details : CVE-2021-44228 Usage : root@kitploit: ----------------------------------------------------- java -jar JNDIExploit-1.2.jar -i AttackerIP -i, --ip Local ip address -l, --ldapPort Ldap bind port default: 1389 -p, --httpPort Http bind port default: 8080 -u, --usag...

Log4j_scan_Advance

log4j-scan A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts Features Support for lists of URLs. Fuzzing for more than 60 HTTP request headers not only 3-4 headers as previously seen tools. Fuzzing for HTTP POST Data parameters. Fuzzing for JSON data parameters...

cve-2025-64446-fortiweb-exploit

CVE-2025-64446 Fortinet FortiWeb 路径遍历远程代码执行漏洞利用工具 一款用于检测和测试 Fortinet FortiWeb Web 应用防火墙 WAF 中 CVE-2025-64446 漏洞的安全研究工具。此严重零日路径遍历漏洞已在野外被积极利用，允许未经身份验证的攻击者绕过安全控制并执行任意代码。 ⚠️ 免责声明 此工具仅用于授权的安全测试和教育目的 。未经授权访问计算机系统是违法的。请仅在你拥有或已获得明确书面许可的系统上使用此工具。 📋 概述 CVE-2025-64446 是 Fortinet FortiWeb WAF...

lua-resty-waf

Name lua-resty-waf - High-performance WAF built on the OpenResty stack Table of Contents Name Status Description Requirements Performance Installation Synopsis Public Functions lua-resty-waf.loadsecrules lua-resty-waf.init Public Methods lua-resty-waf:new lua-resty-waf:setoption...

CVE-2025-55182-poc-tool

CVE-2025-55182-poc-tool A powerful exploit tool for detecting and exploiting CVE-2025-55182 vulnerability in Next.js React Server Components. This tool allows remote command execution RCE in vulnerable Next.js applications with built-in WAF bypass capabilities. Overview CVE-2025-55182 is a critic...

React2Shell_Hunter

React2Shell Hunter AWS Organization-Wide Detection Toolkit for CVE-2025-55182 & CVE-2025-66478 ⚠️ IMPORTANT DISCLAIMER - PLEASE READ BEFORE USE This toolkit has NOT been tested in a production AWS environment. Due to infrastructure constraints, this project was developed and validated through code...

CVE-2024-27198-TeamCity

Mitigation methods: regexp on WAF root@kitploit: REQUESTURI Regex ^\S\?jsp=\S;\.jsp...

wp2shell-Exploit-Waf-Bypass

root@kitploit: | \ / / / / / | | /| / / \ / // / / / / / | |/ |/ / // // / / / / / / / |/|/////// ///// WordPress Pre-Auth RCE — CVE-2026-63030 + CVE-2026-60137 by Venexy M4xSec Unauthenticated Remote Code Execution on WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, 7.0.0–7.0.1. Patched in 6.8.6, 6.9.5,...

Next.js-RCE-Scanner---CVE-2025-55182-CVE-2025-66478

🔍 Next.js RCE Scanner - CVE-2025-55182 & CVE-2025-66478 A powerful and easy-to-use scanner for detecting critical RCE vulnerabilities in Next.js applications 🎯 Overview An advanced vulnerability scanner for detecting CVE-2025-55182 and CVE-2025-66478 - critical Remote Code Execution RCE...

burp-awesome-tls

Awesome TLS This extension hijacks Burp's HTTP and TLS stack, allowing you to spoof any browser TLS fingerprint JA3. It boosts the power of Burp Suite while reducing the likelihood of fingerprinting by various WAFs like CloudFlare, PerimeterX, Akamai, DataDome, etc. This extension works without...

Check Risk WAF

Check Risk WAF Российское комплексное облачное WAF-решение для защиты веб-приложений и инфраструктуры Russian integrated cloud WAF solution for web application and infrastructure protection Сайт · Документация · Русский · English Русская версия Check Risk WAF – это Российское комплексное облачное...

CVE-2025-55182-Waf

Next.js/React RSC Scanner & Exploit - RCE This tool is designed for security researchers and penetration testers to detect and exploit the CVE-2025-55182 vulnerability in Next.js/React RSC applications. It provides multiple scanning modes, exploitation features, and WAF bypass techniques...