Share
## https://sploitus.com/exploit?id=35EBC394-AC53-55FF-A53B-FCEBA70E9258
# ChromSploit Framework v2.2 ๐
<div align="center">
[](https://www.python.org/downloads/)
[](LICENSE)
[]()
[]()
[]()
**Professional Security Research Platform for Browser Vulnerability Analysis**
โจ *Multi-CVE exploitation chains with advanced obfuscation and automated tunneling* โจ
</div>
---
## ๐ฏ Overview
ChromSploit Framework is a cutting-edge educational security research tool designed for cybersecurity professionals, researchers, and students. Built with a modular architecture, it provides a comprehensive platform for studying browser vulnerabilities and exploitation techniques in controlled environments.
> โ ๏ธ **IMPORTANT**: This framework is intended **exclusively** for educational purposes and authorized security testing. Unauthorized use is strictly prohibited and may violate applicable laws.
### ๐ Key Highlights
- **๐ Multi-Exploit Chains**: Automated combination of multiple CVEs
- **๐ญ Advanced Obfuscation**: EXTREME-level payload obfuscation with 9+ techniques
- **๐ Auto-Ngrok Integration**: Automatic tunnel creation for seamless exploitation
- **๐ก๏ธ Safety-First Design**: Built-in simulation modes for safe testing
- **๐ Professional Reporting**: Comprehensive PDF/HTML/JSON reports
- **๐ฌ Live Demonstrations**: Integrated asciinema recordings
---
## โจ Features
<table>
<tr>
<td width="50%">
### ๐ฅ Core Capabilities
- **6 Advanced CVE Exploits** with real functional code
- **Browser Multi-Exploit Chain** for automated attacks
- **AI-Powered Orchestration** for intelligent exploit selection
- **Live Monitoring Dashboard** with real-time metrics
- **Self-Healing Modules** for resilient operations
- **Enhanced Error Handling** with smart recovery
</td>
<td width="50%">
### ๐ ๏ธ Advanced Features
- **Extreme Payload Obfuscation** (Control Flow, String Encryption, Anti-VM)
- **Automatic Ngrok Tunneling** (TCP, HTTP, WebSocket)
- **Professional Security Reports** (PDF, HTML, Markdown)
- **Terminal Recording System** with web playback
- **Modular Plugin Architecture** for extensibility
- **Comprehensive Test Framework** with validation
</td>
</tr>
</table>
---
## ๐ฌ Live Demonstrations
See ChromSploit Framework in action:
<div align="center">
[](asciinema/chromsploit_complete_demo.cast)
</div>
### Quick Feature Demos
| Feature | Demo | Description |
|---------|------|-------------|
| ๐ Framework | [Startup Demo](asciinema/01_framework_startup.cast) | Framework initialization and basics |
| ๐ CVE Exploits | [Exploit Overview](asciinema/02_cve_exploits.cast) | Available CVE modules showcase |
| โก Mojo IPC | [CVE-2025-2783](asciinema/04_exploit_execution.cast) | Chrome sandbox escape demo |
| ๐ง WebAssembly | [WASM JIT](asciinema/05_wasm_jit.cast) | Edge JIT type confusion |
| ๐ฑ Tomcat RCE | [Apache Exploit](asciinema/06_tomcat_rce.cast) | WAR deployment attack |
| ๐ Git RCE | [Repository Attack](asciinema/07_git_rce.cast) | Symbolic link exploitation |
---
## โก Quick Start
### Prerequisites
- **Python 3.9+** with pip
- **Git** for repository operations
- **Virtual Environment** (recommended)
- **Administrative privileges** (for some features)
### ๐ Installation
```bash
# 1. Clone the repository
git clone https://github.com/YourUsername/ChromSploit-Framework.git
cd ChromSploit-Framework
# 2. Create virtual environment
python3 -m venv venv
source venv/bin/activate # Windows: venv\Scripts\activate
# 3. Install dependencies
pip install -r requirements.txt
# 4. Launch ChromSploit
python chromsploit.py
```
### ๐ฏ First Run
```bash
# Safe mode (recommended for first run)
python chromsploit.py --simulation safe
# With debug output
python chromsploit.py --debug
# Environment check
python chromsploit.py --check
```
---
## ๐ฅ CVE Exploit Arsenal
<details>
<summary><b>๐ฅ Click to expand CVE details</b></summary>
### Browser Exploits
| CVE ID | Target | Type | Description | Status |
|--------|--------|------|-------------|--------|
| **CVE-2025-4664** | Chrome | Data Leak | Link header referrer policy bypass | โ
Functional |
| **CVE-2025-2783** | Chrome | Sandbox Escape | Mojo IPC handle confusion | โ
Functional |
| **CVE-2025-30397** | Edge | Memory Corruption | WebAssembly JIT type confusion | โ
Functional |
| **CVE-2025-2857** | Chrome | Auth Bypass | OAuth token manipulation | โ
Functional |
### Server-Side Exploits
| CVE ID | Target | Type | Description | Status |
|--------|--------|------|-------------|--------|
| **CVE-2025-24813** | Apache Tomcat | RCE | Malicious WAR deployment | โ
Functional |
| **CVE-2024-32002** | Git | RCE | Symbolic link repository attack | โ
Functional |
</details>
---
## ๐ Browser Multi-Exploit Chain
The flagship feature that automates exploitation of multiple browser CVEs in sequence:
<div align="center">
```mermaid
graph LR
A[๐ CVE-2025-4664<br/>Reconnaissance] --> B[๐ CVE-2025-2857<br/>OAuth Theft]
B --> C[๐ง CVE-2025-30397<br/>WebAssembly JIT]
C --> D[๐ฅ CVE-2025-2783<br/>Sandbox Escape]
style A fill:#e1f5fe
style B fill:#f3e5f5
style C fill:#fff3e0
style D fill:#ffebee
```
</div>
### ๐ญ Enhanced Features
- **๐ฅ Extreme Obfuscation**: Control flow flattening, string encryption, anti-debugging
- **๐ Auto-Ngrok**: Automatic tunnel creation for all callbacks
- **โก Parallel Execution**: Multi-threaded exploitation for speed
- **๐ฅท Stealth Mode**: Low-profile exploitation with evasion
---
## ๐ ๏ธ Architecture
<details>
<summary><b>๐ System Architecture Overview</b></summary>
```
ChromSploit Framework
โโโ ๐ฏ Core Engine
โ โโโ Enhanced Menu System
โ โโโ Module Loader
โ โโโ Exploit Chain Manager
โ โโโ Error Handler
โโโ ๐ฅ Exploit Modules
โ โโโ Browser CVEs (4)
โ โโโ Server CVEs (2)
โ โโโ Custom Exploits
โโโ ๐ญ Obfuscation Engine
โ โโโ JavaScript Obfuscation
โ โโโ Binary Data Encryption
โ โโโ Control Flow Flattening
โ โโโ Anti-Analysis
โโโ ๐ Network Integration
โ โโโ Ngrok Manager
โ โโโ HTTP Servers
โ โโโ WebSocket Handlers
โโโ ๐ Reporting System
โโโ PDF Generation
โโโ HTML Reports
โโโ JSON Export
```
</details>
### ๐๏ธ Design Patterns
- **๐ Modular Architecture**: Plugin-based system for easy extension
- **๐ก๏ธ Safety-First**: Simulation modes prevent accidental exploitation
- **๐ Enhanced Logging**: Structured logging with analysis capabilities
- **๐ Chain Management**: Dependency resolution and state sharing
- **๐จ Professional UI**: Color-coded menus with keyboard shortcuts
---
## ๐ Documentation
| Document | Description |
|----------|-------------|
| ๐ [Installation Guide](docs/INSTALLATION.md) | Detailed setup instructions for all platforms |
| ๐๏ธ [Architecture Guide](docs/ARCHITECTURE.md) | System design and component overview |
| ๐ง [Developer Guide](docs/DEVELOPMENT.md) | Contributing and extending the framework |
| ๐ [API Reference](docs/API_REFERENCE.md) | Complete API documentation |
| ๐ [Usage Examples](docs/EXAMPLES.md) | Practical usage scenarios |
| ๐ [Security Guidelines](docs/SECURITY.md) | Responsible disclosure and safety |
---
## ๐งช Testing
```bash
# Run all tests
python -m pytest
# With coverage report
python -m pytest --cov=core --cov=modules --cov-report=html
# Validation framework
python -m core.validation_framework
# Specific test
python -m pytest tests/test_browser_chain.py -v
```
**Test Coverage**: 95%+ across core modules
---
## ๐ What's New in v2.2
<details>
<summary><b>๐ Major Updates & Features</b></summary>
### ๐ฅ New Features
- **Browser Multi-Exploit Chain**: Automated 4-CVE browser attacks
- **Enhanced Obfuscation Engine**: 9+ obfuscation techniques
- **Auto-Ngrok Integration**: Seamless tunnel management
- **Apache Tomcat RCE**: CVE-2025-24813 implementation
- **Git Repository RCE**: CVE-2024-32002 exploitation
- **Advanced WebAssembly**: Real WASM JIT type confusion
### ๐ ๏ธ Improvements
- **Performance**: 40% faster exploit execution
- **UI/UX**: Enhanced menu system with shortcuts
- **Logging**: Structured logging with analysis
- **Error Handling**: Smart recovery mechanisms
- **Documentation**: Comprehensive guides and examples
### ๐ง Technical
- **Python 3.9+** compatibility
- **Type Hints** throughout codebase
- **Async Support** for parallel operations
- **Memory Management** optimizations
- **Cross-Platform** compatibility
</details>
---
## ๐ค Contributing
We welcome contributions from the security research community!
<table>
<tr>
<td width="50%">
### ๐ฏ How to Contribute
1. **Fork** the repository
2. **Create** a feature branch
3. **Implement** your changes
4. **Add** comprehensive tests
5. **Submit** a pull request
</td>
<td width="50%">
### ๐ Contribution Areas
- ๐ **Bug Reports & Fixes**
- โจ **New CVE Implementations**
- ๐ **Documentation Improvements**
- ๐งช **Test Coverage Expansion**
- ๐จ **UI/UX Enhancements**
</td>
</tr>
</table>
Please read our [Contributing Guide](CONTRIBUTING.md) for detailed information.
---
## ๐ Security & Ethics
### โ๏ธ Responsible Use
This framework is designed for:
- โ
**Educational purposes** and learning
- โ
**Authorized penetration testing**
- โ
**Security research** in controlled environments
- โ
**Bug bounty programs** with proper authorization
### ๐ซ Prohibited Uses
- โ **Unauthorized access** to systems or networks
- โ **Malicious attacks** on third-party systems
- โ **Commercial exploitation** without permission
- โ **Distribution of malware** or harmful content
### ๐ก๏ธ Safety Features
- **Simulation Modes**: Safe testing without real exploitation
- **Audit Logging**: Complete action tracking
- **Confirmation Prompts**: For dangerous operations
- **Educational Flags**: Clear marking of all educational content
---
## ๐ License
This project is licensed under the **Apache License 2.0** - see the [LICENSE](LICENSE) file for details.
### ๐ Summary
- โ
Commercial use allowed (with restrictions)
- โ
Modification and distribution permitted
- โ
Patent use granted
- โ **Must include license and copyright notice**
- โ **No warranty provided**
---
## ๐ Acknowledgments
<div align="center">
### ๐ช Built by Security Researchers, for Security Researchers
**Special Thanks To:**
- ๐ **Educational Security Community**
- ๐ฌ **Vulnerability Researchers**
- ๐ก๏ธ **Responsible Disclosure Programs**
- ๐ค **Open Source Contributors**
</div>
---
## ๐ Support & Contact
<table>
<tr>
<td width="33%" align="center">
### ๐ Issues
[Report Bugs](../../issues)
Found a bug? Let us know!
</td>
<td width="33%" align="center">
### ๐ฌ Discussions
[Join Discussion](../../discussions)
Community Q&A and ideas
</td>
<td width="33%" align="center">
### ๐ง Security
[security@chromsploit.org](mailto:security@chromsploit.org)
Responsible disclosure
</td>
</tr>
</table>
---
<div align="center">
### ๐ Star us on GitHub if ChromSploit Framework helped your security research! ๐
**Made with โค๏ธ by the ChromSploit Team**
[](../../stargazers)
[](../../network/members)
</div>