
🎯 Automated vulnerability scanner for React2Shell RCE - Google dorking + safe detection for CVE-2025-55182/CVE-2025-66478 (CVSS 10.0)
React2Shell adalah kerentanan Remote Code Execution (RCE) kritikal yang mempengaruhi:
| Target | Versi Vulnerable |
|---|---|
| ⚛️ react-server-dom-webpack | 19.0.0, 19.1.0, 19.1.1, 19.2.0 |
| ⚛️ react-server-dom-turbopack | 19.0.0, 19.1.0, 19.1.1, 19.2.0 |
| ⚛️ react-server-dom-parcel | 19.1.0, 19.1.1, 19.2.0 |
| 🔺 Next.js | 15.0.0-15.0.4, 16.0.0-16.0.6 |
⚠️ CVSS Score: 10.0 (CRITICAL) - Unauthenticated RCE!
# Clone repository
git clone https://github.com/yourusername/react2shell-dork-scanner.git
cd react2shell-dork-scanner
# Install dependencies
pip install -r requirements.txt
python3 dork_scanner.py --test-url https://target.com
# Custom dork
python3 dork_scanner.py --dork "inurl:/_next site:example.com"
# Template bawaan
python3 dork_scanner.py --template nextjs --limit 50
python3 dork_scanner.py --scan-file targets.txt
python3 dork_scanner.py --dork "inurl:/_next" --auto-scan
Google Dork Options:
--dork, -d Custom Google dork query
--template, -t Template: nextjs, react, rsc
--limit, -l Max results (default: 50)
--delay Delay antar request (default: 3.0s)
Scanning Options:
--scan-file, -f Scan dari file
--test-url, -u Test single URL
--auto-scan Auto scan setelah dorking
--threads Concurrent threads (default: 5)
--timeout Request timeout (default: 10s)
Output Options:
--output-targets File untuk targets (default: targets.txt)
--output-vuln File untuk vulns (default: vulnerable.txt)
| Template | Dorks |
|---|---|
nextjs | inurl:"/_next/static", intext:"__NEXT_DATA__" |
react |
| File | Isi |
|---|---|
📄 targets.txt | Semua URL dari Google dork |
🔴 vulnerable.txt | URL yang vulnerable |
⚠️ LEGAL WARNING
Tool ini HANYA untuk security testing pada target yang memiliki izin resmi. Penggunaan tanpa otorisasi adalah ILEGAL.
🔒 Stay Secure. Scan Responsibly. 🔒
| Feature | Description |
|---|
| 🔍 Google Dorking | Cari target Next.js/React otomatis via Google |
| 💾 Save Targets | Simpan hasil pencarian ke targets.txt |
| 🎯 Vuln Scanning | Test vulnerability pada setiap target |
| 📝 Vuln Report | Simpan target vulnerable ke vulnerable.txt |
| ⚡ Multi-threading | Scan cepat dengan concurrent requests |
| 🛡️ Safe Detection | Side-channel detection (tanpa eksploitasi) |
inurl:"/static/js/main" intext:"react" |
rsc | inurl:"/api/" intext:"server-action" |