kaxm23/CVE-2025-55182-Auto-Scanner

``` CVE-2025-55182 Scanner is a high-performance tool for detecting vulnerable Next.js Server Action endpoints. It uses multi-threaded scanning, confidence-based detection, and multiple response indicators to identify potential Remote Code Execution (RCE) vulnerabilities. ### 功能 - High-speed concurrent scanning - Confidence-based vulnerability scoring - WAF bypass payload generation - Header & response pattern analysis - Real-time progress tracking - Automatic saving of vulnerable targets --- ## 工作原理 The scanner follows these steps: 1. Load target URLs from file 2. Generate specially crafted payload 3. Send HTTP request to target 4. Analyze response headers and body 5. Calculate vulnerability confidence score 6. Mark target as vulnerable if score ≥ 40% 7. Save vulnerable targets to file Detection is based on: - Next.js specific headers - React Server Component responses - Error message patterns - HTTP 500 status codes - Payload reflection in response - Response behavior anomalies --- ## 如何运行 ### 1. 安装依赖 ```bash pip3 install -r requirements.txt ``` ### 2. 创建目标文件 ``` https://example.com https://target.com http://127.0.0.1:3000 ``` ### 3. 运行扫描器 基础扫描： ``` python3 scanner.py -l targets.txt ``` 使用线程： ``` python3 scanner.py -l targets.txt -t 30 ``` 详细模式： ``` python3 scanner.py -l targets.txt -v ``` 快速扫描： ``` python3 scanner.py -l targets.txt -t 50 --timeout 5 ``` ## 输出 存在漏洞的目标将保存至： ``` vulnerable.txt ``` 示例输出： ``` [VULN] https://target.com - Confidence: 85% [VULN] https://app.vercel.app - Confidence: 72% ```

标签：CISA项目, CTF工具, CVE-2025-55182, Payload生成, Python安全工具, RCE, Server Actions, WAF绕过, Web安全, 响应分析, 多线程扫描, 子域名暴力破解, 漏洞搜索, 编程工具, 网络安全, 自动化检测, 蓝队分析, 远程代码执行, 逆向工具, 隐私保护, 风险评分