Exploit for shadow-pentest CVE-2021-44228

## https://sploitus.com/exploit?id=F1CE2A81-BFB1-5B60-AEFB-35DC4D23F0F4
# 🖤 Shadow Pentest Framework v1.0

> Automated CVE Discovery & Exploit Validation — Red Team Tool

**For authorized penetration testing engagements only.**

---

## Features

- **Full Recon** — Port scan, service fingerprinting, OS detection, web tech detection, SSL analysis
- **CVE Lookup** — NVD/NIST API v2, filtered by CVSS score, with public exploit detection
- **Exploit Validation** — Real active testing: RCE, SQLi, XSS, LFI, Auth Bypass, Info Disclosure
- **Professional Reports** — PDF + JSON, ready to hand to remediation teams
- **Cross-platform** — Windows, Linux, macOS

---

## Installation

```bash
# 1. Install nmap (required)
# Linux:   sudo apt install nmap
# macOS:   brew install nmap
# Windows: https://nmap.org/download.html

# 2. Install Python dependencies
pip install -r requirements.txt
```

---

## Usage

```bash
# Basic scan
python main.py 

# With custom CVSS threshold (only HIGH+ vulnerabilities)
python main.py 192.168.1.1 --cvss 7.0

# Fast mode — CVE list only, no exploit validation
python main.py example.com --skip-validate

# Full scan with custom output directory
python main.py 10.0.0.5 --cvss 6.0 --timeout 15 --output /tmp/reports

# Limit to top 10 CVEs by CVSS
python main.py target.com --top-cves 10
```

---

## Pipeline

```
[Target Input]
     │
     ▼
[1] RECON
   ├── Nmap: ports, services, versions, OS
   ├── Web: server headers, technologies
   └── SSL: certificate info

     │
     ▼
[2] CVE LOOKUP (NVD API v2)
   ├── Match service+version → CVEs
   ├── Filter by CVSS score
   └── Flag CVEs with public exploits

     │
     ▼
[3] EXPLOIT VALIDATION
   ├── Fetch exploit (Exploit-DB / GitHub PoC)
   ├── Categorize: RCE / SQLi / XSS / LFI / Auth / Info
   └── Active test → VULNERABLE / NOT_VULNERABLE / UNVERIFIED

     │
     ▼
[4] REPORT
   ├── PDF — professional, ready for client delivery
   └── JSON — machine-readable, SIEM integration
```

---

## Output Example

```
╔══════════════════════════════════════════╗
║     SHADOW PENTEST FRAMEWORK v1.0        ║
║  Automated CVE Discovery & Validation    ║
║     For Authorized Engagements Only      ║
╚══════════════════════════════════════════╝

┌─ PHASE 1: RECONNAISSANCE
[+] Resolved IP: 93.184.216.34
[Open Services Table]

┌─ PHASE 2: CVE LOOKUP
[CVE Findings Table — 12 CVEs found]

┌─ PHASE 3: EXPLOIT VALIDATION
[VULNERABLE]  CVE-2021-44228 — RCE confirmed via /api?cmd=...
[NOT_VULNERABLE] CVE-2022-1234 — payload did not execute

┌─ PHASE 4: REPORT GENERATION
[+] PDF Report: ./reports/shadow_report_target_20250515_112800.pdf
[+] JSON Report: ./reports/shadow_report_target_20250515_112800.json
```

---

## Validation Types

| Type | Method |
|------|--------|
| RCE | Command injection payload reflection |
| SQLi | Boolean-based blind + error disclosure |
| XSS | Reflected payload in response |
| LFI | File content exposure (/etc/passwd) |
| Auth Bypass | Default creds + SQLi login bypass |
| Info Disclosure | Sensitive file exposure (.env, .git, etc.) |
| DoS | Safe: connectivity check only |

---

*Shadow Red Team — Authorized use only*