PoC/Browser → Dart Proxy (4000) → Next.js Server (3000)

dart pub global activate react2shell_analyzer

dependencies:
  react2shell_analyzer: ^1.0.0

dart pub get

# Start with defaults (proxy on 4000, forwards to localhost:3000)
react2shell_analyzer

# Custom configuration
react2shell_analyzer --proxy-port 8080 --target-port 3000 --target-host example.com

# Disable specific features
react2shell_analyzer --no-headers --no-color

import 'package:react2shell_analyzer/react2shell_analyzer.dart';

void main() async {
  final config = ProxyConfig(
    proxyPort: 4000,
    targetHost: 'localhost',
    targetPort: 3000,
  );

  await runProxy(config: config);
}

[a3f8bc21] POST /api/action
Time: 2025-12-07T10:30:45.123Z

REQUEST HEADERS:
  content-type: multipart/form-data; boundary=----WebKitFormBoundary
  next-action: abc123def456

MULTIPART REQUEST BODY:
  Found 2 parts

  PART 1:
    Content-Disposition: form-data; name="0"
    
    Content:
      {"action":"$@1","data":{"userId":123}}

  PART 2:
    Content-Disposition: form-data; name="1_$ACTION_REF_1"
    
    Content:
      $K:1234567890abcdef

[a3f8bc21] RESPONSE: 200

⚠️  SUSPICIOUS PATTERNS DETECTED:
   [React Flight action reference] \$@ at Part 1
     Context: {"action":"$@1","data":{"userId":123}}
   [React Flight key marker] \$K: at Part 2
     Context: $K:1234567890abcdef