# 克隆仓库
git clone https://github.com/wi3memake/React2Shell-Scanner.git
cd react2shell-scanner

# 创建虚拟环境（推荐）
python -m venv venv
source venv/bin/activate  # Linux/Mac
.\venv\Scripts\activate   # Windows

# 安装依赖
pip install -r requirements.txt

requests>=2.28.0    # HTTP 客户端库
tqdm>=4.64.0        # 进度条可视化
urllib3>=1.26.0     # URL 处理

# 单个目标
python react2shell.py.py -u https://example.com

# 详细输出
python react2shell.py.py -u https://example.com -v

# 从文件扫描
python react2shell.py.py -l targets.txt

# 使用并发线程
python react2shell.py.py -l targets.txt -t 10

# 自定义请求头
python react2shell.py.py -u https://example.com -H "Authorization: Bearer token"

# 通过代理
python react2shell.py.py -u https://example.com --proxy http://127.0.0.1:8080

# 跳过 SSL 验证
python react2shell.py.py -u https://example.com --no-verify

# 输出到文件
python react2shell.py.py -u https://example.com -o results.json

React2Shell Web Application Security Assessment Framework

[*] Starting assessment of https://example.com
[*] Analyzing React Server Components...
[*] Testing redirect behavior...
[+] Assessment complete

Target: https://example.com
Status: Analyzed
Response Code: 200
Server: Next.js
React Version: 18.2.0
RSC Detected: Yes
Assessment Time: 1.23s

{
  "target": "https://example.com",
  "timestamp": "2025-01-15T10:30:00Z",
  "results": {
    "status_code": 200,
    "server": "Next.js",
    "rsc_detected": true,
    "headers": {
      "content-type": "text/html",
      "x-powered-by": "Next.js"
    },
    "assessment_time": 1.23
  }
}

React2Shell-Scanner/
├── react2shell.py.py      # 主扫描脚本
├── requirements.txt       # Python 依赖
└── README.md             # 文档

https://target1.com
https://target2.com
https://target3.com/api

python react2shell.py.py -u https://example.com \
  -H "Authorization: Bearer token123" \
  -H "X-Custom-Header: value" \
  -H "Cookie: session=abc123"

# HTTP 代理
--proxy http://127.0.0.1:8080

# HTTPS 代理
--proxy https://proxy.example.com:8443

# 需要认证的代理
--proxy http://user:[email protected]:8080

# GitHub Actions 示例
security-scan:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v3
    - name: Setup Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.10'
    - name: Install dependencies
      run: pip install -r requirements.txt
    - name: Run security scan
      run: python react2shell.py.py -u ${{ secrets.TARGET_URL }} -o results.json

import subprocess
import json

# 运行扫描器
result = subprocess.run(
    ['python', 'react2shell.py.py', '-u', 'https://example.com', '-o', 'results.json'],
    capture_output=True,
    text=True
)

# 解析结果
with open('results.json') as f:
    findings = json.load(f)

# 增加超时时间
python react2shell.py.py -u https://example.com --timeout 30

# 跳过验证（仅限测试）
python react2shell.py.py -u https://example.com --no-verify

# 减少线程数
python react2shell.py.py -l targets.txt -t 2