## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-CROPNET-NI8MARE
# 🔒 Ni8mare Scanner
**Ethical Security Scanner for CVE-2026-21858 (Ni8mare Vulnerability)**
> "Knowledge is power, but only if shared responsibly."
Comprehensive vulnerability detection tool for n8n workflow automation instances. Detects the critical CVE-2026-21858 vulnerability (CVSS 10.0) without performing any exploitation.
## ⚡ Quick Start
root@kitploit:~
# Navigate to scripts directory
cd ni8mare-scanner/scripts
# Install dependencies
pip install -r requirements.txt
# Check if a version is vulnerable
python n8n_scanner.py version-check 1.120.0
# Scan a live instance
python n8n_scanner.py scan https://n8n.example.com:5678
# Get CVE information
python n8n_scanner.py info
## 🎯 CVE-2026-21858 Overview
**Severity** : CVSS 10.0 (Critical)
**Fixed In** : n8n v1.121.0
**Discovered By** : Dor Attias (Cyera Research Labs)
**Tool Maintained By** : CropNet on GitHub, by Schema.cx organisation research team
Critical vulnerability allowing **unauthenticated attackers** to read arbitrary files through Content-Type confusion.
This scanner performs **non-invasive detection only** \- never exploits the vulnerability.
## ✨ Features
* ✅ **Version Detection** \- Automatically identifies n8n version and checks vulnerability status
* ✅ **Multiple Scan Modes** \- Light, medium, and deep scan intensities
* ✅ **Batch Scanning** \- Scan multiple targets from a file
* ✅ **Flexible Output** \- JSON, CSV, HTML, Markdown, or plain text reports
* ✅ **Rate Limiting** \- Configurable delays to respect target systems
* ✅ **Authorization Checks** \- Interactive confirmation for compliance
* ✅ **Ethical Design** \- Non-exploitative detection only
## 📖 Usage Examples
### Check a Specific Version
root@kitploit:~
# Check vulnerable version
python n8n_scanner.py version-check 1.120.0
# Output: Status 🔴 VULNERABLE (exit code 2)
# Check safe version
python n8n_scanner.py version-check 1.121.0
# Output: Status 🟢 Not Vulnerable (exit code 0)
### Scan a Live Instance
root@kitploit:~
# Basic scan
python n8n_scanner.py scan https://n8n.example.com:5678
# Deep scan with JSON output
python n8n_scanner.py scan https://n8n.example.com:5678 \
--intensity deep \
--format json \
--output report.json
# Skip authorization prompt (for pre-authorized scans)
python n8n_scanner.py scan https://n8n.example.com:5678 --no-confirm
### Batch Scanning Multiple Targets
root@kitploit:~
# Create targets file
cat > targets.txt << EOF
https://n8n1.example.com:5678
https://n8n2.example.com:5678
https://n8n3.example.com:5678
EOF
# Scan all targets
python n8n_scanner.py batch targets.txt --output results.csv --format csv
### Generate Configuration
root@kitploit:~
# Generate YAML config to stdout
python n8n_scanner.py generate-config --format yaml
# Generate JSON config to file
python n8n_scanner.py generate-config --format json --output config.json
# Use config file for scanning
python n8n_scanner.py scan https://n8n.example.com:5678 --config config.json
## 🎮 Available Commands
### Command Options
#### `scan` Command
root@kitploit:~
python n8n_scanner.py scan <target> [OPTIONS]
**Options:**
* `--intensity, -i` \- Scan intensity: `light`, `medium`, `deep` (default: medium)
* `--output, -o` \- Output file path
* `--format, -f` \- Output format: `json`, `csv`, `html`, `text`, `markdown`
* `--timeout, -t` \- Request timeout in seconds (default: 30)
* `--delay, -d` \- Delay between requests (default: 2.0)
* `--no-confirm` \- Skip authorization confirmation
* \- Configuration file path
#### `version-check` Command
root@kitploit:~
python n8n_scanner.py version-check <version_or_url>
**Exit Codes:**
* `0` \- Version is safe (patched)
* `1` \- Error occurred
* `2` \- Version is vulnerable
**Examples:**
root@kitploit:~
# Check version string
python n8n_scanner.py version-check 1.120.0
# Check live instance version
python n8n_scanner.py version-check https://n8n.example.com:5678
## ⚙️ Configuration
### Configuration File Format
root@kitploit:~
# config.yml
scan:
intensity: medium
timeout: 30
rate_limit:
delay: 2.0
max_requests: 100
targets:
- https://n8n.example.com:5678
require_confirmation: true
output:
format: json
directory: ./reports
### Scan Profiles
Four pre-configured profiles available:
* **quick** \- Light intensity, 15s timeout, 1s delay
* **standard** \- Medium intensity, 30s timeout, 2s delay (default)
* **thorough** \- Deep intensity, 60s timeout, 3s delay
* **compliance** \- Deep intensity, 60s timeout, 5s delay, detailed logging
Generate with: `python n8n_scanner.py generate-config --profile thorough`
## 📊 Output Formats
### JSON (Machine-Readable)
root@kitploit:~
{
"target": "https://n8n.example.com:5678",
"version": "1.120.0",
"vulnerable": true,
"cve": "CVE-2026-21858",
"severity": "CRITICAL"
}
### CSV (Spreadsheet)
root@kitploit:~
Target,Version,Vulnerable,CVE,Severity
https://n8n.example.com:5678,1.120.0,true,CVE-2026-21858,CRITICAL
### HTML (Reports)
Professional HTML reports with styling and charts.
### Text (Terminal)
Color-coded human-readable output with severity indicators.
### Markdown (Documentation)
Documentation-friendly format for wikis and reports.
## 🐳 Docker Support
root@kitploit:~
# Build with Docker Compose
docker-compose build
# Run commands
docker-compose run --rm scanner version-check 1.120.0
docker-compose run --rm scanner scan https://n8n.example.com:5678 --no-confirm
# Batch scan with mounted file
docker-compose run --rm \
-v $(pwd)/targets.txt:/app/targets.txt \
scanner batch /app/targets.txt
## 🔧 Development
### Project Structure
root@kitploit:~
ni8mare-scanner/
├── scripts/
│ ├── n8n_scanner.py # Main CLI
│ ├── modules/ # Core modules
│ │ ├── scanner.py # Scanning logic
│ │ ├── detector.py # Vulnerability detection
│ │ ├── reporter.py # Report generation
│ │ ├── config.py # Configuration
│ │ └── utils.py # Utilities
│ ├── tests/ # Test suite
│ └── build.py # Build automation
├── docs/ # Documentation
└── docker/ # Docker configs
### Running Tests
root@kitploit:~
# Quick functionality test (recommended)
cd scripts
python quick_test.py
# Full test suite
python build.py test
# Test specific module
python -m pytest tests/test_config.py -v
**Quick Test Results:**
root@kitploit:~
[Test] Version Vulnerability Detection [OK]
[Test] Configuration Loading [OK]
[Test] Scanner Creation [OK]
[Test] Detector Creation [OK]
[Test] Reporter Creation [OK]
[Test] Utility Functions [OK]
Results: 6 passed, 0 failed
### Build Automation
root@kitploit:~
# Install dependencies
python build.py install
# Run all tests
python build.py test
# Run linters
python build.py lint
# Format code
python build.py format
# Build distribution
python build.py build
# Clean artifacts
python build.py clean
# Full build pipeline
python build.py all
## 🔒 Security & Ethics
### Authorization Required
The scanner requires explicit authorization:
root@kitploit:~
⚠️ AUTHORIZATION REQUIRED
You are about to scan: https://n8n.example.com:5678
Are you authorized to test this target? [y/N]:
### Ethical Use Policy
**Required:**
* ✅ Obtain written authorization before scanning
* ✅ Use only for legitimate security assessments
* ✅ Report findings responsibly
* ✅ Respect rate limits and target systems
**Prohibited:**
* ❌ Unauthorized scanning or access attempts
* ❌ Exploiting detected vulnerabilities
* ❌ Causing service disruption
* ❌ Public disclosure without coordination
### Responsible Disclosure
If you discover vulnerable instances:
1. **Do NOT exploit** the vulnerability
2. **Contact the organization** privately
3. **Provide remediation guidance** (upgrade to 1.121.0+)
4. **Allow reasonable time** for patching (90 days recommended)
5. **Coordinate disclosure** before publishing
## 🙏 Attribution
### CVE Discovery
**CVE-2026-21858** discovered by:
* **Researcher** : Dor Attias
* **Organization** : Cyera Research Labs
* **Disclosure** : January 2024
### Scanner Development
This scanner was developed as an ethical security tool to help organizations identify and remediate the Ni8mare vulnerability. It performs detection only and never exploits vulnerabilities.
## 📝 License
MIT License - See LICENSE file for details.
**Third-Party Components:**
* requests (Apache 2.0), click (BSD 3-Clause), pydantic (MIT), pyyaml (MIT), jinja2 (BSD 3-Clause)
## 📞 Support
* **Bug Reports** : Open an issue on GitHub
* **Feature Requests** : Label with `enhancement`
* **Security Issues** : Report privately via email
## ❓ FAQ
**Q: Will this exploit the vulnerability?**
A: No. Detection only, never exploits.
**Q: Can I scan without authorization?**
A: No. Always obtain written authorization first.
**Q: What versions are vulnerable?**
A: All n8n versions below 1.121.0 are vulnerable.
**Q: How accurate is the detection?**
A: Very high accuracy with low false-positive rates.
**Q: Can I use this in CI/CD pipelines?**
A: Yes. Use `--no-confirm` and `--json-logs` for automation.
**Q: Does it work on Windows?**
A: Yes. All Unicode compatibility issues have been resolved.
## 🎯 Quick Reference
### Installation
root@kitploit:~
cd ni8mare-scanner/scripts
pip install -r requirements.txt
### Common Commands
root@kitploit:~
# Version check
python n8n_scanner.py version-check 1.120.0
# Scan instance
python n8n_scanner.py scan https://n8n.example.com:5678
# Batch scan
python n8n_scanner.py batch targets.txt
# Generate config
python n8n_scanner.py generate-config --format yaml > config.yml
# Show help
python n8n_scanner.py --help
python n8n_scanner.py scan --help
### Exit Codes
* `0` = Safe/Success
* `1` = Error
* `2` = Vulnerable
* * *
**Made with ❤️ for the security community**
_This tool is provided as-is for ethical security testing only. The authors are not responsible for misuse or damage caused by this tool._