Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/hndko/react2shell-rce-autobot
ReconnaissanceVulnerability ScannersExploitationWeb Application ExploitationInformation GatheringPenetration Testing
GitHubhndko/react2shell-rce-autobot

react2shell-rce-autobot

🎯 Automated vulnerability scanner for React2Shell RCE - Google dorking + safe detection for CVE-2025-55182/CVE-2025-66478 (CVSS 10.0)

View Repository
7 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
react2shell-rce-autobot — 🎯 Automated vulnerability scanner for React2Shell RCE - Google dorking + safe detection for CVE-2025-55182/CVE-2025-66478 (CVSS 10.0) | Kitploit

🔍 React2Shell Dork Scanner

CVE-2025-55182 CVE-2025-66478 CVSS 10.0

Python 3.8+ Next.js React License


🚨 Tentang Kerentanan

React2Shell adalah kerentanan Remote Code Execution (RCE) kritikal yang mempengaruhi:

TargetVersi Vulnerable
⚛️ react-server-dom-webpack19.0.0, 19.1.0, 19.1.1, 19.2.0
⚛️ react-server-dom-turbopack19.0.0, 19.1.0, 19.1.1, 19.2.0
⚛️ react-server-dom-parcel19.1.0, 19.1.1, 19.2.0
🔺 Next.js15.0.0-15.0.4, 16.0.0-16.0.6

⚠️ CVSS Score: 10.0 (CRITICAL) - Unauthenticated RCE!


✨ Features


📦 Installation

root@kitploit:~
# Clone repository
git clone https://github.com/yourusername/react2shell-dork-scanner.git
cd react2shell-dork-scanner

# Install dependencies
pip install -r requirements.txt

🚀 Quick Start

1️⃣ Test Single URL

root@kitploit:~
python3 dork_scanner.py --test-url https://target.com

2️⃣ Google Dork Search

root@kitploit:~
# Custom dork
python3 dork_scanner.py --dork "inurl:/_next site:example.com"

# Template bawaan
python3 dork_scanner.py --template nextjs --limit 50

3️⃣ Scan dari File

root@kitploit:~
python3 dork_scanner.py --scan-file targets.txt

4️⃣ Full Auto (Dork + Scan)

root@kitploit:~
python3 dork_scanner.py --dork "inurl:/_next" --auto-scan

📖 CLI Options

root@kitploit:~
Google Dork Options:
  --dork, -d          Custom Google dork query
  --template, -t      Template: nextjs, react, rsc
  --limit, -l         Max results (default: 50)
  --delay             Delay antar request (default: 3.0s)

Scanning Options:
  --scan-file, -f     Scan dari file
  --test-url, -u      Test single URL
  --auto-scan         Auto scan setelah dorking
  --threads           Concurrent threads (default: 5)
  --timeout           Request timeout (default: 10s)

Output Options:
  --output-targets    File untuk targets (default: targets.txt)
  --output-vuln       File untuk vulns (default: vulnerable.txt)

🎯 Dork Templates

TemplateDorks
nextjsinurl:"/_next/static", intext:"__NEXT_DATA__"
react

📊 Output Files

FileIsi
📄 targets.txtSemua URL dari Google dork
🔴 vulnerable.txtURL yang vulnerable

⚠️ Disclaimer

⚠️ LEGAL WARNING

Tool ini HANYA untuk security testing pada target yang memiliki izin resmi. Penggunaan tanpa otorisasi adalah ILEGAL.


🔗 References

  • 📋 CVE-2025-55182
  • 📋 CVE-2025-66478
  • 🔬 Assetnote Research

🔒 Stay Secure. Scan Responsibly. 🔒

Download Tool
FeatureDescription
🔍 Google DorkingCari target Next.js/React otomatis via Google
💾 Save TargetsSimpan hasil pencarian ke targets.txt
🎯 Vuln ScanningTest vulnerability pada setiap target
📝 Vuln ReportSimpan target vulnerable ke vulnerable.txt
⚡ Multi-threadingScan cepat dengan concurrent requests
🛡️ Safe DetectionSide-channel detection (tanpa eksploitasi)
inurl:"/static/js/main" intext:"react"
rscinurl:"/api/" intext:"server-action"