🔥 CVE-2025-55184 Advanced Exploitation Tool

---

🎯 About CVE-2025-55184

CVE-2025-55184 is a high-severity Denial of Service (DoS) vulnerability affecting React Server Components (RSC) implementations. The vulnerability allows remote attackers to cause complete service disruption through specially crafted circular reference payloads.

📊 Vulnerability Details

Property	Value
CVE ID	CVE-2025-55184
CVSS Score	7.5 (High)
Attack Vector	Network (Remote)
Complexity	Low
Privileges Required	None (Unauthenticated)
Impact	Complete DoS, Resource Exhaustion

🎯 Affected Frameworks

• ❌ Next.js (versions 13.x - 14.1.0)
• ❌ Waku (versions < 0.19.2)
• ❌ Remix (versions < 2.5.1)
• ❌ Any RSC-enabled React app (React 18.0.0 - 18.2.0)

✅ Patched Versions

• ✅ Next.js ≥ 14.1.1
• ✅ Waku ≥ 0.19.2
• ✅ Remix ≥ 2.5.1
• ✅ React ≥ 18.3.0

---

🔥 What Makes This Tool Special?

This isn't just a basic PoC - it's a professional-grade exploitation framework designed for serious security researchers and bug bounty hunters.

⚡ Unique Features

• 🎯 Sustained Attack Mode - Keeps target down until you stop it (Ctrl+C for auto-recovery!)
• 🛡️ Advanced WAF Bypass - Auto-detects and evades 8+ major WAFs (Cloudflare, AWS, Akamai, etc.)
• 🎨 Beautiful Terminal UI - Cyberpunk-themed with live dashboards
• 📊 Professional Reports - JSON/Markdown/HTML with CVSS scoring
• 🔐 Ethical Safeguards - Built-in authorization checks and disclaimers
• 💣 10+ Payload Variants - Base64, URL, Unicode, Hex encoding & more

---

🚀 Quick Start

Installation (One Command!)

git clone https://github.com/CyberTechAjju/CVE-2025-55184-POC-Expolit.git
cd CVE-2025-55184-POC-Expolit
./run.sh

That's it! Dependencies auto-install, interactive menu guides you.

Alternative Methods

# Python directly
python3 exploit.py

# Advanced CLI mode
python3 cve_2025_55184_exploit.py -t <target> -m scan

---

💻 Features

🎯 8 Attack Modes

Mode	Description	Use Case
1. Detect	Passive fingerprinting	Safe reconnaissance
2. Scan	Active vulnerability testing	Confirmation
3. Single	One-shot PoC	Quick demo
4. Multi	Multi-threaded (5 threads)	Moderate testing
5. Aggressive	High-impact (10+ threads)	Authorized pentest
6. WAF	WAF detection & bypass	Protected targets
7. Report	Generate documentation	Bug bounty submission
8. Sustained	🔥 NEW! Continuous DoS	Keeps target down!

💥 Sustained Attack Mode (Killer Feature!)

./run.sh
# Choose: 3 (SUSTAINED ATTACK)
# ✅ Target goes DOWN and STAYS DOWN
# ✅ Press Ctrl+C → Target RECOVERS automatically

Perfect for:

• Testing DoS resilience
• Demonstrating impact to clients
• Bug bounty proof-of-concept
• Authorized penetration testing

🛡️ WAF Bypass Capabilities

Auto-detected WAFs:

• Cloudflare
• AWS WAF
• Akamai
• Imperva
• F5 BIG-IP
• Sucuri
• ModSecurity
• Wordfence

Evasion Techniques:

• Multiple encoding (Base64, URL, Unicode, Hex)
• Header obfuscation & randomization
• User-Agent rotation (6+ profiles)
• HTTP request smuggling
• Null byte injection
• Double encoding chains
• Timing variation
• Proxy header spoofing

---

📖 Documentation

• docs/QUICKSTART.md - ⚡ Quick start guide (READ THIS FIRST!)
• docs/USAGE.md - Comprehensive usage guide
• docs/BUG_BOUNTY_EMAIL_TEMPLATE.md - Professional email report format
• config/config.json - Configuration reference
• config/payloads.json - Payload database

---

🎥 Related Resources

📹 CVE-2025-55182 Exploit Tutorial

Looking for CVE-2025-55182 exploitation? Check out this video:

▶️ Watch on YouTube: CVE-2025-55182 Exploitation

---

🎨 Screenshots

Terminal Banner

╔══════════════════════════════════════════════════════════╗
║                                                          ║
║     ______     ________    _____    ___   ___            ║
║    / ____/    / ____/ /   / __  \  / _ \ / _ \           ║
║   / /   __   / /_  / /    \__ \ / / /_\ / /_\ \          ║
║  / /__ /  \ /___/ / /___ ___/ /_/\__  /\__  /           ║
║  \____/    /_____/______//____/     /_/   /_/            ║
║                                                          ║
║   by CyberTechAjju | "KEEP LEARNING KEEP HACKING"       ║
╚══════════════════════════════════════════════════════════╝

Live Attack Dashboard

⚡ LIVE ATTACK DASHBOARD ⚡
┌─────────────────────────────────────────────────┐
│ Total Requests        │    847    │     ✓       │
│ Successful Attacks    │    521    │     💥      │
│ Timeouts              │    521    │     ⏱️      │
│ Errors                │    326    │     ❌      │
│ Success Rate          │   61.5%   │     🎯      │
└─────────────────────────────────────────────────┘

---

💡 Usage Examples

Example 1: Quick Vulnerability Check

./run.sh
Enter target: http://localhost:3000
Choose: 1 (Quick Scan)
Authorization: YES I AM AUTHORIZED
# Results in seconds!

Example 2: Sustained DoS Attack

./run.sh
Enter target: http://vulnerable-site.com
Choose: 3 (SUSTAINED ATTACK)
Authorization: YES I AM AUTHORIZED
Type: ATTACK
# Target goes down
# Monitor impact
# Press Ctrl+C when done
# Target recovers automatically!

Example 3: WAF-Protected Target

./run.sh
Enter target: https://protected.cloudflare.com
Choose: 4 (WAF Bypass)
# Auto-detects Cloudflare
# Tries encoding variations
# Shows bypass success/failure

---

📊 Payload Arsenal

This tool includes 10+ exploit variations:

Payload Type	Encoding	Success Rate	Description
Basic	None	95%	Original circular reference
URL Encoded	URL	80%	Bypass simple filters
Base64	Base64	75%	Evade pattern matching
Double URL	2x URL	70%	Advanced WAF bypass
Unicode	Unicode	65%	Character encoding evasion
Hex	Hexadecimal	60%	Hex escape sequences
Mixed	Various	55%	Combined techniques
Fragmented	Split	50%	Fragment-based bypass
Nested	None	85%	Deeper recursion
Array-based	None	70%	Array circular refs

---

🔐 Ethical Safeguards

Built-in Protection Mechanisms