Professional-grade Denial of Service (DoS) exploitation framework for CVE-2025-55184 targeting React Server Components. Features 8 attack modes, WAF bypass, and 10+ payload variants for authorized security testing and bug bounty hunting.
"KEEP LEARNING KEEP HACKING" - CyberTechAjju
🚀 Quick Start • 📖 Documentation • 💻 Features • ⚠️ Disclaimer
CVE-2025-55184 is a high-severity Denial of Service (DoS) vulnerability affecting React Server Components (RSC) implementations. The vulnerability allows remote attackers to cause complete service disruption through specially crafted circular reference payloads.
| Property | Value |
|---|---|
| CVE ID | CVE-2025-55184 |
| CVSS Score | 7.5 (High) |
| Attack Vector | Network (Remote) |
| Complexity | Low |
| Privileges Required | None (Unauthenticated) |
| Impact | Complete DoS, Resource Exhaustion |
This isn't just a basic PoC - it's a professional-grade exploitation framework designed for serious security researchers and bug bounty hunters.
git clone https://github.com/CyberTechAjju/CVE-2025-55184-POC-Expolit.git
cd CVE-2025-55184-POC-Expolit
./run.sh
That's it! Dependencies auto-install, interactive menu guides you.
# Python directly
python3 exploit.py
# Advanced CLI mode
python3 cve_2025_55184_exploit.py -t <target> -m scan
| Mode | Description | Use Case |
|---|---|---|
| 1. Detect | Passive fingerprinting | Safe reconnaissance |
| 2. Scan | Active vulnerability testing | Confirmation |
| 3. Single | One-shot PoC | Quick demo |
| 4. Multi | Multi-threaded (5 threads) | Moderate testing |
| 5. Aggressive | High-impact (10+ threads) | Authorized pentest |
| 6. WAF | WAF detection & bypass | Protected targets |
| 7. Report | Generate documentation | Bug bounty submission |
| 8. Sustained | 🔥 NEW! Continuous DoS | Keeps target down! |
./run.sh
# Choose: 3 (SUSTAINED ATTACK)
# ✅ Target goes DOWN and STAYS DOWN
# ✅ Press Ctrl+C → Target RECOVERS automatically
Perfect for:
Auto-detected WAFs:
Evasion Techniques:
Looking for CVE-2025-55182 exploitation? Check out this video:
╔══════════════════════════════════════════════════════════╗
║ ║
║ ______ ________ _____ ___ ___ ║
║ / ____/ / ____/ / / __ \ / _ \ / _ \ ║
║ / / __ / /_ / / \__ \ / / /_\ / /_\ \ ║
║ / /__ / \ /___/ / /___ ___/ /_/\__ /\__ / ║
║ \____/ /_____/______//____/ /_/ /_/ ║
║ ║
║ by CyberTechAjju | "KEEP LEARNING KEEP HACKING" ║
╚══════════════════════════════════════════════════════════╝
⚡ LIVE ATTACK DASHBOARD ⚡
┌─────────────────────────────────────────────────┐
│ Total Requests │ 847 │ ✓ │
│ Successful Attacks │ 521 │ 💥 │
│ Timeouts │ 521 │ ⏱️ │
│ Errors │ 326 │ ❌ │
│ Success Rate │ 61.5% │ 🎯 │
└─────────────────────────────────────────────────┘
./run.sh
Enter target: http://localhost:3000
Choose: 1 (Quick Scan)
Authorization: YES I AM AUTHORIZED
# Results in seconds!
./run.sh
Enter target: http://vulnerable-site.com
Choose: 3 (SUSTAINED ATTACK)
Authorization: YES I AM AUTHORIZED
Type: ATTACK
# Target goes down
# Monitor impact
# Press Ctrl+C when done
# Target recovers automatically!
./run.sh
Enter target: https://protected.cloudflare.com
Choose: 4 (WAF Bypass)
# Auto-detects Cloudflare
# Tries encoding variations
# Shows bypass success/failure
This tool includes 10+ exploit variations:
| Payload Type | Encoding | Success Rate | Description |
|---|---|---|---|
| Basic | None | 95% | Original circular reference |
| URL Encoded | URL | 80% | Bypass simple filters |
| Base64 | Base64 | 75% | Evade pattern matching |
| Double URL | 2x URL | 70% | Advanced WAF bypass |
| Unicode | Unicode | 65% | Character encoding evasion |
| Hex | Hexadecimal | 60% | Hex escape sequences |
| Mixed | Various | 55% | Combined techniques |
| Fragmented | Split | 50% | Fragment-based bypass |
| Nested | None | 85% | Deeper recursion |
| Array-based | None | 70% | Array circular refs |
✅ Authorization Prompts - Must type "YES I AM AUTHORIZED" before every attack
✅ Legal Warnings - Displayed on startup with clear guidelines
✅ Graceful Shutdown - Ctrl+C stops cleanly, allows target recovery
✅ Rate Limiting - Configurable delays prevent unintended damage
✅ Scope Validation - Authorized domains list in config
✅ Comprehensive Logging - All actions logged for accountability
🚨 AUTHORIZED USE ONLY 🚨
This tool is designed EXCLUSIVELY for:
✅ Authorized penetration testing with written permission
✅ Bug bounty programs within defined scope
✅ Security research in controlled environments
✅ Educational purposes on your own infrastructure
UNAUTHORIZED USE IS STRICTLY PROHIBITED AND ILLEGAL!
The author (CyberTechAjju) assumes NO responsibility for:
❌ Misuse of this tool
❌ Unauthorized testing or attacks
❌ Damage to systems or services
❌ Legal consequences from improper use
By using this tool, you agree to:
✓ Obtain explicit written authorization before testing
✓ Comply with all applicable laws and regulations
✓ Follow responsible disclosure practices
✓ Use only for legitimate security research
Perfect for professional bug bounty hunting:
graph LR
A[Recon] --> B[Detect Mode]
B --> C[Scan Mode]
C --> D[Confirm Vuln]
D --> E[Generate Report]
E --> F[Submit]
F --> G[Reward! 💰]CVE-2025-55184-POC-Expolit/
├── run.sh # 🚀 Quick launcher (START HERE!)
├── exploit.py # 🎯 Simple interactive mode
├── cve_2025_55184_exploit.py # 🔧 Advanced CLI tool
├── requirements.txt # 📦 Dependencies
├── README.md # 📄 This file
├── .gitignore # Ignore patterns
│
├── modules/ # 🔌 Core modules
│ ├── ui_manager.py # 🎨 Terminal UI engine
│ ├── waf_bypass.py # 🛡️ WAF evasion module
│ └── utils.py # 🔧 Utilities & reporting
│
├── config/ # ⚙️ Configuration files
│ ├── config.json # Settings & attack modes
│ └── payloads.json # 💣 Exploit database (10+ variants)
│
└── docs/ # 📚 Documentation
├── QUICKSTART.md # ⚡ Quick start guide
├── USAGE.md # 📖 Detailed documentation
└── BUG_BOUNTY_EMAIL_TEMPLATE.md # 📧 Email report format
"$@0")Next-Action: x or framework-specific headers// Vulnerable RSC deserialization logic
function deserialize(payload) {
if (payload.startsWith("$@")) {
const ref = parseInt(payload.substring(2));
return deserialize(payload); // ← Infinite recursion!
}
}
Contributions welcome! Areas for improvement:
Note: All contributions must maintain ethical use principles.
Author: CyberTechAjju
Motto: "KEEP LEARNING KEEP HACKING"
Found a bug? Have suggestions? Open an issue!
Authorized Use Only - This tool is provided for legitimate security testing purposes only. Unauthorized use is prohibited by law.
If this tool helped you in bug bounty or security research:
"KEEP LEARNING KEEP HACKING"
Empowering ethical hackers to make the web more secure, one vulnerability at a time.
