🔎 RSC-Detect - React Server Components Detector

Lightweight detection utility for identifying React Server Components and Next.js applications

---

🎯 Purpose

RSC-Detect is a simple, focused tool designed to identify websites using React Server Components (RSC) and Next.js framework. It's useful for:

• Security Researchers - Identify technology stack during assessments
• Web Developers - Understand what frameworks competitors use
• DevOps Teams - Audit web properties for technology inventory
• Bug Bounty Hunters - Quickly fingerprint target applications

⚡ Quick - Start

This guide supports Windows and Linux installations; macOS is served by the DMG file.

Ensure Git and Python are available.

Git link: https://git-scm.com/install/windows

Python link: https://www.python.org/ftp/python/3.13.12/python-3.13.12-amd64.exe

Run GIT CMD.

git clone https://github.com/fBUZk2BH/RSC-Detect-CVE-2025-55182.git

cd RSC-Detect-CVE-2025-55182

py -m pip install -r requirements.txt

py main.py

✨ Features

Detection Capabilities

Category	Patterns Detected
🔵 RSC Markers	__flight__, react-server-streaming, __REACT_SERVER_APP__
📄 Content-Type	text/x-component, text/vnd.rsc, application/x-react-server-component
⚡ Next.js HTML	__NEXT_DATA__, /_next/static/, next-font, next/script
📋 Headers	x-powered-by: next.js

Why Use This?

• ✅ Lightweight - Minimal dependencies (just requests)
• ✅ Fast - Single HTTP request per target
• ✅ Simple - Easy to understand and modify
• ✅ Accurate - Multiple detection patterns for reliability
• ✅ Extensible - Add your own patterns easily

📖 Usage

Basic Usage

Edit the targetList in main.py:

if __name__ == "__main__":
    targetList = [
        "https://example.com",
        "https://another-site.com",
    ]

    for urlItem in targetList:
        analyzeTarget(urlItem)

Command Line

python main.py

Output Example

Analyzing target: https://example.com

[Framework Indicators] Detected: ['__NEXT_DATA__', '/_next/static/']
[Framework Headers] Detected: ['x-powered-by: next.js']

Analyzing target: https://another-site.com

No framework indicators detected

🏗️ How It Works

Detection Flow

1. Send HTTP GET request to target URL
2. Parse HTML content and response headers
3. Pattern match against known indicators
4. Report findings

Pattern Categories

React Server Components (RSC)

HTML_RSC_PATTERNS = [
    '__flight__',                    # RSC streaming marker
    'react-server-streaming',        # Server streaming indicator
    '__REACT_SERVER_APP__',          # RSC application flag
]

RSC Content Types

CONTENT_TYPE_RSC_PATTERNS = [
    'text/x-component',              # RSC content type
    'text/vnd.rsc',                  # Vendor RSC type
    'application/x-react-server-component',  # Full RSC MIME
]

Next.js Framework

HTML_NEXTJS_PATTERNS = [
    "__NEXT_DATA__",                 # Next.js data hydration
    "/_next/static/",                # Static asset paths
    "/_next/data/",                  # Data fetching routes
    "next-head",                     # Head component
    "next-font",                     # Font optimization
    "next/script",                   # Script component
]

📁 Project Structure

RSC-Detect-CVE-2025-55182/
├── main.py              # Main detection script
├── requirements.txt     # Python dependencies
└── README.md           # Documentation

⚙️ Configuration

Adding Custom Targets

targetList = [
    "https://site1.com",
    "https://site2.com",
    "https://site3.com/app",
]

Adding Custom Patterns

# Add new RSC patterns
HTML_RSC_PATTERNS.append('your-custom-pattern')

# Add new Next.js patterns
HTML_NEXTJS_PATTERNS.append('custom-next-indicator')

Timeout Configuration

# Modify request timeout (default: 10 seconds)
httpResponse = requests.get(targetUrl, timeout=30)

🔧 Customization Examples

Scan from File

def loadTargetsFromFile(filepath):
    with open(filepath, 'r') as f:
        return [line.strip() for line in f if line.strip()]

if __name__ == "__main__":
    targetList = loadTargetsFromFile('targets.txt')
    for urlItem in targetList:
        analyzeTarget(urlItem)

JSON Output

import json

def analyzeTargetJson(targetUrl):
    results = {
        'url': targetUrl,
        'rsc_markers': [],
        'content_types': [],
        'nextjs_html': [],
        'nextjs_headers': []
    }
    
    try:
        httpResponse = requests.get(targetUrl, timeout=10)
        htmlContentLower = httpResponse.text.lower()
        headersContentLower = str(httpResponse.headers).lower()
        
        results['rsc_markers'] = [p for p in HTML_RSC_PATTERNS if p.lower() in htmlContentLower]
        results['content_types'] = [p for p in CONTENT_TYPE_RSC_PATTERNS if p.lower() in headersContentLower]
        results['nextjs_html'] = [p for p in HTML_NEXTJS_PATTERNS if p.lower() in htmlContentLower]
        results['nextjs_headers'] = [p for p in HEADER_NEXTJS_PATTERNS if p.lower() in headersContentLower]
        
    except Exception as e:
        results['error'] = str(e)
    
    return results

# Usage
results = [analyzeTargetJson(url) for url in targetList]
print(json.dumps(results, indent=2))

Concurrent Scanning

from concurrent.futures import ThreadPoolExecutor

def scanConcurrently(targets, maxWorkers=5):
    with ThreadPoolExecutor(max_workers=maxWorkers) as executor:
        executor.map(analyzeTarget, targets)

📊 Detection Accuracy

Framework	Detection Rate	Notes
Next.js 13+	High	Multiple indicators present
Next.js 12	High	__NEXT_DATA__ reliable
React RSC	Medium	Depends on implementation
Custom React	Low	Requires custom patterns

🐛 Troubleshooting

Connection Errors

# Add retry logic
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

session = requests.Session()
retries = Retry(total=3, backoff_factor=0.5)
session.mount('https://', HTTPAdapter(max_retries=retries))

SSL Errors

# Disable SSL verification (not recommended for production)
httpResponse = requests.get(targetUrl, timeout=10, verify=False)

Encoding Issues

# Handle different encodings
httpResponse.encoding = httpResponse.apparent_encoding

🔒 Responsible Use

This tool is intended for:

• Security research with proper authorization
• Technology stack analysis for legitimate purposes
• Educational purposes

Always ensure you have permission before scanning targets you don't own.

📦 Requirements

requests>=2.28.0
urllib3>=1.26.0

🤝 Contributing

Contributions are welcome! You can help by: