RSC Fingerprint Detector

A Chrome extension for detecting React Server Components (RSC) and Next.js App Router fingerprints on web pages.

⚠️ Important Notice

This extension is intended for educational and security research purposes only. It includes functionality that may be used to test for potential security weaknesses. Use it only on systems you own or have explicit permission to test. Unauthorized use may be illegal and unethical.

Features

🔍 Passive Detection

• Automatically scans pages for RSC indicators
• Detects Next.js App Router behavior
• Monitors page content for RSC‑specific markers
• Updates the extension badge when RSC is detected

🎯 Active Fingerprinting

• Sends controlled RSC probe requests
• Analyzes server responses for RSC traits
• Identifies RSC‑related Content-Type headers
• Detects Vary headers containing RSC

📊 Detection Methods

The extension uses several complementary techniques:

1. Content-Type Analysis – Detects text/x-component responses
2. Pattern Matching – Flags window.__next_f and other RSC patterns
3. Header Inspection – Scans Vary headers for RSC indicators
4. Response Structure Analysis – Looks for React Flight protocol signatures

Installation

From Source

1. Clone the repository:

   root@kitploit:~

   git clone https://github.com/mrknow001/RSC_Detector.git
   cd RSC_Detector
   

2. Load the extension in Chrome:

   • Go to chrome://extensions/
   • Enable Developer mode
   • Click Load unpacked
   • Select the RSC_Detector folder

Usage

1. Automatic Detection — The extension runs passively while you browse
2. Manual Probe — Click the extension icon and choose Start Fingerprint Probe
3. View Results — The popup displays detection status and technical details

Screenshot

The screenshot shows the extension detecting RSC usage, including passive indicators and active probe results.

File Structure

RSC_Detector/
├── manifest.json          # Extension configuration
├── content.js             # Main detection logic
├── popup.html             # Popup UI
├── popup.js               # Popup logic
├── background.js          # Background worker
├── rules.json             # Network request rules
├── images/
│   └── img1.png           # Screenshot
├── README.md              # English documentation
└── README_cn.md           # Chinese documentation

Technical Details

Detection Patterns

This extension looks for:

• Content-Type: text/x-component
• Global Variables: window.__next_f
• Library References: react-server-dom-webpack
• Response Headers: Vary: RSC
• Protocol Patterns: React Flight response format

Permissions

Required Chrome permissions:

• activeTab — Access current tab’s content
• scripting — Execute scripts on pages
• declarativeNetRequest — Inspect/modify network requests
• <all_urls> — Enable detection across all sites

Contributing

Contributions are welcome. Please ensure that updates:

• Preserve the educational/security‑research intent
• Include clear documentation
• Follow Chrome extension best practices

License

This project is provided strictly for educational use. Use responsibly and comply with all applicable laws and regulations.

Disclaimer

This tool is designed exclusively for legitimate security research and educational purposes. You are responsible for ensuring you have proper authorization before testing any system. The authors assume no liability for misuse.

Documentation

• English: README.md
• 中文: README_cn.md

⚠️ For authorized security testing only.

RSC Fingerprint Detector

A Chrome extension for detecting React Server Components (RSC) and Next.js App Router fingerprints on web pages.

⚠️ Important Notice

This extension is intended for educational and security research purposes only. It includes functionality that may be used to test for potential security weaknesses. Use it only on systems you own or have explicit permission to test. Unauthorized use may be illegal and unethical.

Features

🔍 Passive Detection

• Automatically scans pages for RSC indicators
• Detects Next.js App Router behavior
• Monitors page content for RSC‑specific markers
• Updates the extension badge when RSC is detected

🎯 Active Fingerprinting

• Sends controlled RSC probe requests
• Analyzes server responses for RSC traits
• Identifies RSC‑related Content-Type headers
• Detects Vary headers containing RSC

📊 Detection Methods

The extension uses several complementary techniques:

1. Content-Type Analysis – Detects text/x-component responses
2. Pattern Matching – Flags window.__next_f and other RSC patterns
3. Header Inspection – Scans Vary headers for RSC indicators
4. Response Structure Analysis – Looks for React Flight protocol signatures

Installation

From Source

1. Clone the repository:

   root@kitploit:~

   git clone https://github.com/mrknow001/RSC_Detector.git
   cd RSC_Detector
   

2. Load the extension in Chrome:

   • Go to chrome://extensions/
   • Enable Developer mode
   • Click Load unpacked
   • Select the RSC_Detector folder

Usage

1. Automatic Detection — The extension runs passively while you browse
2. Manual Probe — Click the extension icon and choose Start Fingerprint Probe
3. View Results — The popup displays detection status and technical details

Screenshot

The screenshot shows the extension detecting RSC usage, including passive indicators and active probe results.

File Structure

RSC_Detector/
├── manifest.json          # Extension configuration
├── content.js             # Main detection logic
├── popup.html             # Popup UI
├── popup.js               # Popup logic
├── background.js          # Background worker
├── rules.json             # Network request rules
├── images/
│   └── img1.png           # Screenshot
├── README.md              # English documentation
└── README_cn.md           # Chinese documentation

Technical Details

Detection Patterns

This extension looks for:

• Content-Type: text/x-component
• Global Variables: window.__next_f
• Library References: react-server-dom-webpack
• Response Headers: Vary: RSC
• Protocol Patterns: React Flight response format

Permissions

Required Chrome permissions:

• activeTab — Access current tab’s content
• scripting — Execute scripts on pages
• declarativeNetRequest — Inspect/modify network requests
• <all_urls> — Enable detection across all sites

Contributing

Contributions are welcome. Please ensure that updates:

• Preserve the educational/security‑research intent
• Include clear documentation
• Follow Chrome extension best practices

License

This project is provided strictly for educational use. Use responsibly and comply with all applicable laws and regulations.

Disclaimer

This tool is designed exclusively for legitimate security research and educational purposes. You are responsible for ensuring you have proper authorization before testing any system. The authors assume no liability for misuse.

Documentation

• English: README.

⚠️ For authorized security testing only.