Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/brianlopezm99/react2shell-cve-2025-55182
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRemote Access Tool
GitHubbrianlopezm99/react2shell-cve-2025-55182

react2shell-CVE-2025-55182

An exploitation tool for the Next.js vulnerability CVE-2025-55182 that allows remote command execution through a poisoning prototype in React Server Components.

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View Repository
16 months agoNot yet reviewed

React2Shell Exploit (CVE-2025-55182)

Python exploit for Next.js React Server Components RCE vulnerability with HTTP/HTTPS support.

🚀 Quick Start

root@kitploit:~
# Clone & run
git clone https://github.com/BrianLopezM99/react2shell-CVE-2025-55182.git
cd react2shell-CVE-2025-55182
python3 exploit_react2shell.py <URL> "<command>"

📖 Usage

root@kitploit:~
# HTTP
python3 exploit_react2shell.py http://target.com:3000 "id"
python3 exploit_react2shell.py 192.168.1.100:8080 "ls -la"

# HTTPS
python3 exploit_react2shell.py https://target.com "whoami"
python3 exploit_react2shell.py https://target.com:8443 "cat /etc/passwd"

✨ Features

  • ✅ HTTP & HTTPS support
  • ✅ Smart URL parsing (automatic protocol detection)
  • ✅ Animated loaders for better UX
  • ✅ Raw socket implementation (no dependencies)
  • ✅ Automatic output extraction
  • ✅ SSL/TLS support for secure connections

⚠️ Legal Notice

For authorized security testing only.
Use only on systems you own or have explicit permission to test. Never use for illegal activities.

📋 Requirements

  • Python 3.6+
  • No external dependencies

🔧 How It Works

  1. Parses target URL (supports http://, https://, or no scheme)
  2. Establishes raw socket connection (with SSL for HTTPS)
  3. Sends crafted multipart/form-data request with prototype pollution payload
  4. Triggers RCE via child_process.execSync()
  5. Extracts command output from server response

🐛 Troubleshooting

  • Connection refused: Check if server is running
  • SSL errors: Target may have certificate issues
  • Timeout: Server may be slow - increase timeout
  • Numeric output: Command output might be truncated

📄 License

MIT License - see LICENSE file

Disclaimer: Educational purposes only. Always obtain proper authorization.

Last Updated: February 8, 2025
Version: 2.0.0 Maintainer: BrianLopezM99

Download Tool