Overview

React2Shell Toolbox is a security testing tool designed for Next.js React Server Actions prototype pollution vulnerability (CVE-2025-55182). It provides a user-friendly GUI with features including POC verification, virtual terminal interaction, FOFA asset search, and advanced route hijacking capabilities.

Screenshots

POC Verification

Virtual Terminal

Batch Verification (FOFA Integration)

Settings

Core Features

✅ POC Verification Module

• Basic vulnerability detection and command execution
• Full response viewing (source/preview dual mode)
• Command output extraction
• Virtual terminal interaction (Linux/macOS support)
• History management (auto-save, favicon display)
• Monaco Editor integration

✅ Batch Verification Module

• FOFA API integration (search, statistics, user info)
• 7 dimensions of statistical aggregation (protocol, domain, port, title, OS, server, location)
• Smart filtering and multi-condition combination
• Search history management
• Request rate control and queue management
• User info display (avatar, VIP status, F-coin/F-point balance)

✅ Settings Management

• Request settings (timeout, SSL certificate)
• Proxy settings (HTTP/HTTPS/SOCKS5)
• FOFA settings (API configuration, connection test, proxy bypass)
• China mirror (GitHub acceleration)
• Auto-update check (optional)
• Advanced features configuration (requires authorization)

Download & Installation

Download the installer for your platform from GitHub Releases:

• Windows: Windows-react2shell-toolbox-{version}-setup.exe or Windows-react2shell-toolbox-{version}-portable.exe
• macOS: macOS-react2shell-toolbox-{version}-x64.dmg (Intel) or macOS-react2shell-toolbox-{version}-arm64.dmg (Apple Silicon)
• Linux: Linux-react2shell-toolbox-{version}-x64.AppImage or .deb / .tar.gz

Build from Source

Requirements

• Node.js >= 18
• npm >= 9

Install Dependencies

npm install

Development Mode

npm run dev

Build Application

# Windows
npm run build:win

# macOS
npm run build:mac

# Linux
npm run build:linux

# All platforms
npm run build:all

Usage Guide

POC Verification

1. Enter target URL and command
2. Click "Execute Detection"
3. View detection results and command output
4. Switch to "Virtual Terminal" for interaction

Batch Verification

1. Configure FOFA API in settings (Get credentials)
2. Enter FOFA search query (e.g., app="Apache-Tomcat")
3. Load statistics and select filter conditions
4. View asset list (coming soon)

Tech Stack

Frontend

• Framework: Vue 3 (Composition API)
• UI Library: Vuetify 3 (Material Design)
• Router: Vue Router 4
• State Management: Pinia
• Code Editor: Monaco Editor
• Terminal: xterm.js + xterm-addon-fit

Backend

• Runtime: Electron 39 + Node.js 18+
• Build Tools: Electron Vite + Electron Builder
• HTTP Client: Axios + Node Fetch
• Proxy Support: https-proxy-agent + socks-proxy-agent
• Markdown Rendering: marked + highlight.js

Project Structure

react2shell-toolbox/
├── src/
│   ├── main/                      # Electron main process
│   │   ├── index.js              # Main process entry
│   │   ├── poc-handler.js        # POC execution handler
│   │   ├── terminal-handler.js   # Virtual terminal handler
│   │   ├── fofa-handler.js       # FOFA API handler
│   │   ├── github-oauth-handler.js # GitHub OAuth handler
│   │   ├── storage-handler.js    # Storage management handler
│   │   └── updater.js            # Auto-update handler
│   ├── preload/                   # Preload scripts
│   │   └── index.js              # IPC communication bridge
│   └── renderer/                  # Renderer process (frontend)
│       ├── src/
│       │   ├── components/       # Vue components
│       │   │   ├── poc/         # POC verification components
│       │   │   ├── batch/       # Batch verification components
│       │   │   └── settings/    # Settings components
│       │   ├── views/           # Page views
│       │   ├── stores/          # Pinia state management
│       │   ├── router/          # Router configuration
│       │   ├── composables/     # Composable functions
│       │   └── App.vue          # Root component
│       └── index.html           # HTML entry
├── resources/                     # Application resources
│   ├── icon.png                 # App icon
│   └── icon.ico                 # Windows icon
├── changelog/                     # Version changelogs
├── electron-builder.yml          # Build configuration
└── package.json                  # Project configuration

Core Modules

Main Process Modules

• poc-handler: Handles POC execution requests with proxy and SSL certificate bypass support
• terminal-handler: Manages virtual terminal sessions and SSE streams
• fofa-handler: Wraps FOFA API for search, statistics, and user info queries
• github-oauth-handler: Implements GitHub OAuth2 flow and Star verification
• storage-handler: Manages local storage (settings, history, favicon cache)
• updater: Handles auto-update checks and downloads

Renderer Process Modules

• stores: Global state management with Pinia (app, settings, POC, FOFA, update)
• composables: Reusable composition functions (POC hijacking, terminal management, etc.)
• components: Modular Vue components organized by functionality

IPC Communication