# Exploit Modules Guide

Best practices for writing and extending exploit modules in Rustsploit.

---

## CVE Referencing

Always mention CVE IDs, vendor names, and affected products in:
- The module file docstring / top-level comments
- Output messages (e.g., `[*] Testing CVE-2025-14847 on {}`, target)
- The [Module Catalog](Module-Catalog.md)

---

## Response Validation

Validate server responses before declaring success — false positives hurt credibility:

```rust
if response.status() == 200 && body.contains("expected_indicator") {
    println!("{} Confirmed vulnerable: {}", "[+]".green(), target);
} else {
    println!("{} Not vulnerable or patched", "[-]".red());
}
```

---

## Artifact Handling

If the exploit downloads or writes files (e.g., memory dumps, webshells):
- Store in the current working directory or a named subfolder
- Name files descriptively: `mongobleed_results_{target}.txt`, `nginx_pwner_results_{target}.txt`
- Inform the operator where output was written

---

## Clean-Up Instructions

If the exploit adds credentials or accounts (e.g., camera modules), document:
- The impact of the change
- How to revert (e.g., default creds to restore, commands to run)

---

## Interactive Options

Use `cfg_prompt_*` helpers from `crate::utils` if end-user input is needed. These respect the priority chain (API custom_prompts > global options > interactive stdin), ensuring modules work in shell, API, and CLI modes:

```rust
use crate::utils::{cfg_prompt_default, cfg_prompt_yes_no};

let command = cfg_prompt_default("command", "Command to execute", "id").await?;
let deploy = cfg_prompt_yes_no("deploy_webshell", "Deploy webshell?", true).await?;
```

---

## Mass-Scan Support

For modules supporting internet-wide scanning (target `0.0.0.0/0`):

```rust
if target == "0.0.0.0" || target == "0.0.0.0/0" || target == "random" {
    loop {
        let ip = generate_random_public_ip();
        if !is_excluded_ip(ip) {
            execute(ip.to_string().as_str()).await.ok();
        }
    }
}
```

See `EXCLUDED_RANGES` documentation in [Security & Validation](Security-Validation.md).

Disable honeypot detection in mass-scan mode to avoid interactive prompts blocking the scan loop.

---

## Module-Specific Notes

### Hikvision RCE (CVE-2021-36260)
- **Safe check** — writes/reads a test file to verify exploitability
- **Unsafe reboot** — reboots the device to confirm (destructive)
- **Command exec** — output retrieved, supports blind mode
- **SSH shell** — deploys Dropbear SSH on port 1337

### MongoBleed (CVE-2025-14847)
- Sends malicious compressed packet with inflated `uncompressedSize`
- Parses error response to extract leaked memory chunks (field names / types)
- Prints any leaked strings (potential credentials / data) to console
- Includes deep-scan mode for extended analysis

### n8n RCE (CVE-2025-68613)
- Authenticates via `/rest/login` (token / cookie-based)
- Creates a malicious workflow with expression injection payload
- Triggers via `/rest/workflows/{id}/run`
- Cleans up test workflow after execution
- **6 payload types:** Info, Command, Environment, Read File, Write File, Reverse Shell

### FortiWeb SQLi → RCE (CVE-2025-25257)
- SQL injection via `Authorization: Bearer ';{injection}` header
- Writes webshell via `SELECT INTO OUTFILE`
- Uses `.pth` trigger for Python `chmod` execution
- Interactive modes: deploy webshell, execute command, test SQLi only

### NginxPwner
- **10 checks:** version disclosure, CRLF injection, PURGE method, variable leakage, merge slashes, header bypass / IP spoofing, alias traversal, `X-Accel-Redirect` bypass, PHP detection, CVE-2017-7529 integer overflow
- Results saved to `nginx_pwner_results_{target}.txt`
- Prints reminders for manual checks (Redis, CORS, request smuggling)

### DoS / Stress Testing

> ⚠️ Authorized testing only. These modules can cause service disruption.

| Module | Notes |
|--------|-------|
| `null_syn_exhaustion` | Raw socket, IP spoofing, XorShift128+ RNG, configurable PPS, >1M PPS capable |
| `connection_exhaustion_flood` | FD-bounded semaphore, supports infinite mode with graceful Ctrl+C |
| `tcp_connection_flood` | DNS pre-resolved, high-concurrency handshake stress, infinite mode |
| `http2_rapid_reset` | CVE-2023-44487 — HTTP/2 stream reset flood |

---

## Framework-Level Multi-Target Support

All exploit modules automatically benefit from the framework's multi-target dispatcher. There is no need to implement target iteration inside individual modules. The framework handles:

- **Comma-separated targets** — `192.168.1.1,192.168.1.2,192.168.1.3`
- **CIDR ranges** — `192.168.1.0/24` expands to all hosts in the subnet
- **File-based targets** — pass a file path containing one target per line
- **Random targets** — `random` or `0.0.0.0/0` generates random public IPs with `EXCLUDED_RANGES` enforcement

The dispatcher calls the module's `run()` function once per resolved target. Modules only need to handle a single target string.