THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING PURPOSES ONLY.

• ❌ DO NOT use this tool on systems you do not own or have explicit written permission to test
• ❌ DO NOT use this tool for malicious purposes
• ✅ DO use this tool only in authorized penetration testing engagements
• ✅ DO use this tool for educational research and learning

Unauthorized access to computer systems is illegal. Misuse of this tool may result in criminal prosecution under laws such as the Computer Fraud and Abuse Act (CFAA) and similar legislation worldwide.

By using this tool, you agree to use it responsibly and legally.

📋 Table of Contents

• About
• Features
• Technology Stack
• Installation
• Usage
• Video Demonstration
• Screenshots
• Multi-Language Support
• Building
• Testing
• Project Structure
• Contributing
• License

🔍 About

RscScan is a professional security tool designed to detect CVE-2025-55182, a critical Remote Code Execution (RCE) vulnerability in Next.js Server Actions. The vulnerability stems from a prototype pollution issue that allows attackers to execute arbitrary code on the server.

Vulnerability Details

✨ Features

Core Functionality

• 🎯 Multi-threaded Scanning - Concurrent scanning of up to 30 targets simultaneously
• 📊 Real-time Progress Tracking - Live progress bar with percentage completion
• 📈 Statistics Dashboard - Visual statistics for vulnerable, safe, and error results
• 🔍 Advanced Filtering - Search and filter results by status, URL, or message
• 📤 Multiple Export Formats - Export results as JSON or CSV
• 🎭 Demo Mode - Safe testing mode with simulated results

Desktop Application Features

• 🖥️ Cross-Platform - Windows, macOS, and Linux support
• 📁 Native File Dialogs - System file picker for target lists
• 💾 Native Save Dialogs - Save exports with system dialog
• 🔔 In-App Notifications - Beautiful toast notifications on scan completion
• 🪟 Window State Persistence - Remembers window size and position
• 🎨 System Tray Integration - Minimize to system tray

User Interface

• 🌍 Multi-Language Interface - Support for English, Persian, Russian, German, and Chinese
• 🌓 Dark/Light Theme - Toggle between themes with system preference detection
• 📱 Responsive Design - Works seamlessly on desktop, tablet, and mobile
• ⌨️ Keyboard Shortcuts - Quick actions with keyboard shortcuts
• 🎨 Professional Design - Clean, modern interface with smooth animations
• 🔤 Custom Fonts - Language-specific fonts (Vazirmatn for Persian, Noto Sans SC for Chinese)

🛠 Technology Stack

Frontend

• React 19.2.1 - Modern UI library with hooks
• Vite 5.3 - Lightning-fast build tool and dev server
• Tailwind CSS 4.1 - Utility-first CSS framework
• Lucide React - Beautiful icon library

Internationalization

• i18next 25.x - Internationalization framework
• react-i18next 16.x - React integration for i18next
• i18next-browser-languagedetector - Automatic language detection

Desktop Framework

• Electron 28 - Cross-platform desktop framework
• Electron Builder 24.9 - Application packaging and distribution

HTTP Client

• Axios 1.13 - Promise-based HTTP client

📥 Download

📦 Installation

Prerequisites

• Node.js 18.x or higher
• npm 9.x or higher
• Git (for cloning)

Clone Repository

Install Dependencies

This will install all required dependencies including React, Electron, i18next, and build tools.

🚀 Usage

Web Application (Development Mode)

Perfect for UI development and testing:

The application will open at http://localhost:5173

Note: Web mode has CORS limitations. For real vulnerability scanning, use the desktop application.

Desktop Application

Development Mode

This will:

1. Start the Vite development server
2. Wait for it to be ready
3. Launch the Electron app with DevTools

Production Build

See BUILD_GUIDE.md for detailed build instructions.

🎥 Video Demonstration

What's Covered in the Video:

• ✅ Installation and setup process
• ✅ Multi-language interface demonstration (EN, FA, RU, DE, ZH)
• ✅ Theme switching (Dark/Light modes)
• ✅ Target configuration and import
• ✅ Real-time scanning and progress tracking
• ✅ Results analysis and filtering
• ✅ Export options (JSON, CSV)

📸 Screenshots

🌍 Multi-Language Support

RscScan provides full interface translation with language-specific optimizations:

Features:

• ✅ Automatic language detection based on system preferences
• ✅ Manual language switching with persistent settings
• ✅ RTL (Right-to-Left) support for Persian
• ✅ Custom web fonts loaded via Google Fonts
• ✅ Professional flag icons using country-flag-icons
• ✅ Complete UI translation (buttons, labels, messages, tooltips)

Adding a New Language:

1. Create translation file: src/locales/{language-code}/translation.json
2. Add language configuration in src/i18n.js
3. Add flag mapping in language selector component
4. Update this README with the new language

🏗️ Building

For detailed build instructions, see BUILD_GUIDE.md.

Quick Build

Output: Built applications will be in the release/ directory.

🧪 Testing

For detailed testing instructions, see TESTING_GUIDE.md.

Quick Start

1. Setup DNS Exfiltration Endpoint

   • Use Burp Collaborator (https://portswigger.net/burp)
   • Or Interactsh (https://app.interactsh.com)

2. Create Target List

   root@kitploit:~

   https://your-lab-url.web-security-academy.net
   http://localhost:3000
   

3. Run Scanner

   root@kitploit:~

   npm run electron:dev
   

📁 Project Structure

🤝 Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines.

Quick Start

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

Translation Contributions

We welcome translations to additional languages! Please follow the structure in src/locales/en/translation.json and submit a PR.

📄 License

MIT License

Copyright (c) 2025 VeilVulp

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

🙏 Acknowledgments

• VeilVulp for development and maintenance
• Next.js team for security disclosures
• Open source security community
• PortSwigger for Web Security Academy
• OWASP for security resources
• Contributors to translation efforts

📞 Support

• Issues: GitHub Issues
• Email: [email protected]
• Instagram: @VeilVulp
• YouTube: @VeilVulp