wi3memake/react2shell-scannerCommand-line security assessment framework for React and Next.js applications, analyzing React Server Components for misconfigurations, with multi-target scanning, WAF detection, and proxy support.
Web Application Security Assessment Framework for React and Next.js Applications
This tool is designed for authorized security testing only.
Users are solely responsible for ensuring compliance with all applicable laws.
React2Shell Scanner is a command-line security assessment framework designed to help security professionals identify potential vulnerabilities in React and Next.js web applications. It focuses on analyzing React Server Components (RSC) implementations for common security misconfigurations.
| Feature | Description |
|---|---|
| 🎯 Multi-Target Scanning | Scan single URLs or lists of targets |
| 🔄 Concurrent Testing | Multi-threaded for efficient assessment |
| 🛡️ WAF Detection | Identify and analyze WAF responses |
| 📊 Progress Tracking | Visual progress bar with tqdm |
| 🔧 Configurable Headers | Custom header injection |
| 🌐 Proxy Support | Route through HTTP/HTTPS proxies |
| 📝 Output Formats | JSON and text report generation |
| 🎨 Colorful CLI | Clear, color-coded terminal output |
# Clone repository
git clone https://github.com/wi3memake/React2Shell-Scanner.git
cd react2shell-scanner
# Create virtual environment (recommended)
python -m venv venv
source venv/bin/activate # Linux/Mac
.\venv\Scripts\activate # Windows
# Install dependencies
pip install -r requirements.txt
requests>=2.28.0 # HTTP client library
tqdm>=4.64.0 # Progress bar visualization
urllib3>=1.26.0 # URL handling
# Single target
python react2shell.py.py -u https://example.com
# With verbose output
python react2shell.py.py -u https://example.com -v
# Scan from file
python react2shell.py.py -l targets.txt
# With concurrent threads
python react2shell.py.py -l targets.txt -t 10
# Custom headers
python react2shell.py.py -u https://example.com -H "Authorization: Bearer token"
# Through proxy
python react2shell.py.py -u https://example.com --proxy http://127.0.0.1:8080
# Skip SSL verification
python react2shell.py.py -u https://example.com --no-verify
# Output to file
python react2shell.py.py -u https://example.com -o results.json
| Argument | Short | Description | Default |
|---|---|---|---|
--url | -u | Single target URL | - |
--list | -l | File with target URLs | - |
--threads | -t | Concurrent threads | 5 |
--timeout | - | Request timeout (seconds) | 10 |
--proxy | - | Proxy URL (http/https) | - |
--headers | -H | Custom headers | - |
--output | -o | Output file path | - |
--no-verify | - | Skip SSL verification | False |
--verbose | -v | Verbose output | False |
--waf-bypass | - | WAF bypass mode | False |
--bypass-size | - | Bypass payload size (KB) | 128 |
React2Shell Web Application Security Assessment Framework
[*] Starting assessment of https://example.com
[*] Analyzing React Server Components...
[*] Testing redirect behavior...
[+] Assessment complete
Target: https://example.com
Status: Analyzed
Response Code: 200
Server: Next.js
React Version: 18.2.0
RSC Detected: Yes
Assessment Time: 1.23s
{
"target": "https://example.com",
"timestamp": "2025-01-15T10:30:00Z",
"results": {
"status_code": 200,
"server": "Next.js",
"rsc_detected": true,
"headers": {
"content-type": "text/html",
"x-powered-by": "Next.js"
},
"assessment_time": 1.23
}
}
React2Shell-Scanner/
├── react2shell.py.py # Main scanner script
├── requirements.txt # Python dependencies
└── README.md # Documentation
Create a text file with one URL per line:
https://target1.com
https://target2.com
https://target3.com/api
Pass multiple headers with repeated -H flags:
python react2shell.py.py -u https://example.com \
-H "Authorization: Bearer token123" \
-H "X-Custom-Header: value" \
-H "Cookie: session=abc123"
# HTTP Proxy
--proxy http://127.0.0.1:8080
# HTTPS Proxy
--proxy https://proxy.example.com:8443
# Authenticated Proxy
--proxy http://user:[email protected]:8080
# GitHub Actions example
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Setup Python
uses: actions/setup-python@v4
with:
python-version: '3.10'
- name: Install dependencies
run: pip install -r requirements.txt
- name: Run security scan
run: python react2shell.py.py -u ${{ secrets.TARGET_URL }} -o results.json
import subprocess
import json
# Run scanner
result = subprocess.run(
['python', 'react2shell.py.py', '-u', 'https://example.com', '-o', 'results.json'],
capture_output=True,
text=True
)
# Parse results
with open('results.json') as f:
findings = json.load(f)
Connection Timeout
# Increase timeout
python react2shell.py.py -u https://example.com --timeout 30
SSL Certificate Errors
# Skip verification (testing only)
python react2shell.py.py -u https://example.com --no-verify
Rate Limiting
# Reduce threads
python react2shell.py.py -l targets.txt -t 2
We welcome contributions that improve:
Please submit issues and pull requests on GitHub.
This project is licensed under the MIT License.
Security Testing Made Efficient
🔒 Always Test Responsibly 🔒