projectdiscovery/nuclei
1
0 Fork 0
mirror of https://github.com/projectdiscovery/nuclei.git synced 2026-11-07 09:46:03 -10:00
Code Issues Packages Projects Releases 1 Wiki Activity
7,126 Commits 106 Branches 147 Tags
dev
Commit Graph
128 Commits
Author SHA1 Message Date
ghost 091191f518 docs: update syntax & JSON schema 🤖 2026-10-29 04:05:50 +00:00
Mzack9999 abcdcf19a4 Merge pull request #7940 from mazzz3r/feat/info-placeholders 
feat(templates): fill placeholders in info description, impact and remediation
 2026-10-27 15:21:09 +01:00
Mzack9999 fa3fa92092 merge dev 2026-10-25 21:15:30 +01:00
Mzack9999 be7b2648ef document ssl 2026-10-25 21:15:30 +01:00
mazzz3r c4552c6011 feat(templates): fill placeholders in info description, impact and remediation 
Description, impact and remediation can reference values of the finding
with the usual {{...}} syntax: named extractors, payload values of the
matching request, variables, DSL helpers, and the result fields host,
port, ip, url, scheme, path, matched-at, matcher-name and
extractor-name, which win over values of the same name. Name, severity,
tags and classification stay static, since filtering, grouping and
issue trackers key on them.

MakeDefaultResultEvent renders each result's copy of the info, so every
protocol gets it and the template never changes. Each field goes
through render.Render without scan options, like request and matcher
text, so nested placeholders and helpers behave the same and network
helpers stay denied. A field whose expression fails keeps the
template's text.

When placeholders change the text, the result keeps the written info in
TemplateInfo (json:"-" bson:"-"):
- the writer runs the -redact patterns over the changed fields, as it
  does over the raw request and response;
- SARIF builds the shared rule from the written info and puts each
  finding's filled text, capped at 4096 characters, in its result
  message.

Info is filled only from a template's own event. Templates with info
placeholders are not clustered, since a cluster's shared event holds the
first template's variables and extracted values, and a global matcher
fills its info from the result fields alone.
 2026-10-25 19:37:42 +00:00
ghost 47f74706a5 docs: update syntax & JSON schema 🤖 2026-09-28 08:35:44 +00:00
ghost af77e344f0 docs: update syntax & JSON schema 🤖 2026-09-24 06:17:10 +00:00
Doğan Can Bakır fcba75d191 record model verdict on llm findings and regen schema 2026-09-14 15:28:32 +03:00
dw1coderabbitai[bot]Mzack9999
 		f5d0ef81a5 feat(http): add RFC 9111 cache w/ per-request disable (#6746) 
* feat(http): add RFC-9111 cache w/ per-request disable

* wrap HTTP transports with sandrolain/httpcache
  and expose global `--no-http-cache` flag.
* allow templates to set `disable-http-cache`.
* bump Go to 1.25.7.

Signed-off-by: Dwi Siswanto <[email protected]>

* ci: pin go version by go.mod

Signed-off-by: Dwi Siswanto <[email protected]>

* build: set GODEBUG=tlssha1=1

Signed-off-by: Dwi Siswanto <[email protected]>

* build(make): add more `GO*` envs for `go-build`

Signed-off-by: Dwi Siswanto <[email protected]>

* chore(cmd): fix typo

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* fix(types): add `DisableHTTPCache` to `Copy` method

Signed-off-by: Dwi Siswanto <[email protected]>

* test: add HTTP cache integration tests

Signed-off-by: Dwi Siswanto <[email protected]>

* refactor: inverse HTTP cache (RFC 9111) logic (opt-in)

Signed-off-by: Dwi Siswanto <[email protected]>

* chore(deps): go mod tidy

Signed-off-by: Dwi Siswanto <[email protected]>

* test(integration): add -http-cache to both HTTP cache test cases

Signed-off-by: Dwi Siswanto <[email protected]>

* filter cache

* bound cache

---------

Signed-off-by: Dwi Siswanto <[email protected]>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Mzack9999 <[email protected]>
 2026-09-07 03:55:36 +07:00
chauhand2463 a1c26f9d98 feat(http): expose TLS key exchange metadata 2026-08-28 09:41:07 +05:30
ghost 9d9012ce29 docs: update syntax & JSON schema 🤖 2026-07-27 08:14:48 +00:00
ghost dd78cd5959 docs: update syntax & JSON schema 🤖 2026-07-26 08:04:11 +00:00
Mzack9999 44e6f5445a dnssec types (#7564) 2026-07-24 10:06:17 +04:00
ghost 17092671a8 docs: update syntax & JSON schema 🤖 2026-07-22 14:24:39 +00:00
Dwi SiswantoandMzack9999 679ee5ef3a feat(protocols): add duration fields to other events (#7428) 
* feat(protocols): add duration fields to other events

Add matcher and extractor duration data[1] for
DNS, SSL, WHOIS, TCP, WebSocket, and Headless
requests.

Track step durations for TCP inputs, WebSocket
message exchanges, and Headless actions. The
`duration` field holds the most recently measured
operation.

Expose request ID-prefixed duration values through
the existing template context path, and add
protocol tests for duration extraction, aliases,
and request ID handling.

[1]: The data exposed is `duration`, `duration_N`,
    `<request-id>_duration`, and
    `<request-id>_duration_<N>`.

Closes #5413
Closes #7422

Signed-off-by: Dwi Siswanto <[email protected]>

* test(protocols): added deterministic 10ms test-server delays

Signed-off-by: Dwi Siswanto <[email protected]>

* test: added a shared integration-test delay constant

Signed-off-by: Dwi Siswanto <[email protected]>

---------

Signed-off-by: Dwi Siswanto <[email protected]>
Co-authored-by: Mzack9999 <[email protected]>
 2026-07-22 18:22:58 +04:00
ghost 2da8669cb0 docs: update syntax & JSON schema 🤖 2026-05-10 10:05:41 +00:00
ghost 1f20707c9a docs: update syntax & JSON schema 🤖 2026-04-15 12:22:29 +00:00
Mikel Olasagasti Uranga 6eda56f389 Remove executable bit (#7282) 2026-03-22 01:55:54 +07:00
ghost d5eafebad2 docs: update syntax & JSON schema 🤖 2026-03-20 14:15:36 +00:00
ghost fe090d7c10 docs: update syntax & JSON schema 🤖 2025-12-07 09:04:58 +00:00
copilot-swe-agent[bot]andAaryanBansal-dev 3d60c9fdbe Fix all documentation errors 
Co-authored-by: AaryanBansal-dev <[email protected]>
 2025-12-07 05:51:53 +00:00
ghost 2449d5628f docs: update syntax & JSON schema 🤖 2025-12-05 14:42:36 +00:00
Didier Durand 3447f09c9f [Doc] Fixing typos in various files 2025-12-05 07:17:14 +01:00
Didier Durand 9ec2e995d0 docs: fixing typos in multiple files (#6653) 
* [Doc] Fixing typos in multiple files

* [Doc] Fixing js.go based in review suggestion
 2025-12-05 12:29:19 +07:00
ghost 81a1159587 docs: update syntax & JSON schema 🤖 2025-10-14 10:57:20 +00:00
ghost f610ed4cab docs: update syntax & JSON schema 🤖 2025-09-15 23:06:45 +00:00
halcyondreamandMzack9999 792998d8e2 Refactored header-based auth scans not to normalize the header names. (#6479) 
* Refactored header-based auth scans not to normalize the header names.

* Removed the header validation as it's not really useful here.

* adding docs

---------

Co-authored-by: Mzack9999 <[email protected]>
 2025-09-16 04:35:00 +05:30
sandeep a09fcc196b auto gen docs update 2024-11-21 18:16:12 +05:30
ghost 159a8a53cf Auto Generate Syntax Docs + JSONSchema [Mon Oct 14 15:26:08 UTC 2024] 🤖 2024-10-14 15:26:08 +00:00
ghost 53f56e179d Auto Generate Syntax Docs + JSONSchema [Mon Oct 14 13:56:50 UTC 2024] 🤖 2024-10-14 13:56:50 +00:00
ghost 690089e1ce Auto Generate Syntax Docs + JSONSchema [Wed Oct 9 21:36:38 UTC 2024] 🤖 2024-10-09 21:36:38 +00:00
ghost 1610d96bc2 Auto Generate Syntax Docs + JSONSchema [Thu Sep 19 13:34:08 UTC 2024] 🤖 2024-09-19 13:34:08 +00:00
ghost cb05f55251 Auto Generate Syntax Docs + JSONSchema [Mon Sep 2 10:01:02 UTC 2024] 🤖 2024-09-02 10:01:02 +00:00
ghost d20ec34f63 Auto Generate Syntax Docs + JSONSchema [Fri Aug 16 12:41:50 UTC 2024] 🤖 2024-08-16 12:41:50 +00:00
GitHub Action 49d8579662 Auto Generate Syntax Docs + JSONSchema [Mon Jul 15 10:28:25 UTC 2024] 🤖 2024-07-15 10:28:25 +00:00
GitHub Action 1c355c54ad Auto Generate Syntax Docs + JSONSchema [Mon Jun 10 23:14:52 UTC 2024] 🤖 2024-06-10 23:14:52 +00:00
GitHub Action f2c0b4b443 Auto Generate Syntax Docs + JSONSchema [Mon Apr 15 14:44:52 UTC 2024] 🤖 2024-04-15 14:44:52 +00:00
GitHub Action 39ee0b7c39 Auto Generate Syntax Docs + JSONSchema [Mon Apr 1 13:49:30 UTC 2024] 🤖 2024-04-01 13:49:30 +00:00
GitHub Action 5ce912e316 Auto Generate Syntax Docs + JSONSchema [Fri Mar 29 08:03:07 UTC 2024] 🤖 2024-03-29 08:03:07 +00:00
GitHub Action f6d0b1cd95 Auto Generate Syntax Docs + JSONSchema [Wed Mar 13 22:02:48 UTC 2024] 🤖 2024-03-13 22:02:48 +00:00
GitHub Action cfe28f0040 Auto Generate Syntax Docs + JSONSchema [Tue Mar 5 17:11:08 UTC 2024] 🤖 2024-03-05 17:11:09 +00:00
GitHub Action e7252a4f9e Auto Generate Syntax Docs + JSONSchema [Fri Mar 1 11:10:06 UTC 2024] 🤖 2024-03-01 11:10:06 +00:00
Ramana ReddyandGitHub Action d60c846439 Fix workflow to publish docs (#4743) 
* Fix workflow to publish docs

* Auto Generate Syntax Docs + JSONSchema [Thu Feb  8 13:24:29 UTC 2024] 🤖

---------

Co-authored-by: GitHub Action <[email protected]>
 2024-02-08 19:13:26 +05:30
Dogan Can BakirTarun Koyalwarsandeep
 		a9efb75d59 introduce disable-cookie (#4292) 
* introduce disable-cookie

* remove debug statement

* fix headless template

* increase `-interactions-poll-duration` value to 5

* docs update

---------

Co-authored-by: Tarun Koyalwar <[email protected]>
Co-authored-by: sandeep <[email protected]>
 2023-11-18 13:02:10 +05:30
GitHub Action 3276703244 Auto Generate Syntax Docs + JSONSchema [Mon Oct 16 09:36:01 UTC 2023] 🤖 2023-10-16 09:36:01 +00:00
Tarun Koyalwar eec907a370 resolve merge conflicts 2023-09-13 20:28:48 +05:30
GitHub Action b77ad93b9e Auto Generate Syntax Docs + JSONSchema [Mon Sep 11 23:06:51 UTC 2023] 🤖 2023-09-11 23:06:51 +00:00
GitHub Action ad015823c1 Auto Generate Syntax Docs + JSONSchema [Mon Sep 4 09:17:02 UTC 2023] 🤖 2023-09-04 09:17:02 +00:00
Tarun Koyalwar 8125b6805c resolve merge conflicts with dev 2023-08-04 20:21:22 +05:30
Josh Soref 4c1c5301b9 Spelling (#4008) 
* spelling: addresses

Signed-off-by: Josh Soref <[email protected]>

* spelling: asynchronous

Signed-off-by: Josh Soref <[email protected]>

* spelling: basic

Signed-off-by: Josh Soref <[email protected]>

* spelling: brute force

Signed-off-by: Josh Soref <[email protected]>

* spelling: constant

Signed-off-by: Josh Soref <[email protected]>

* spelling: disables

Signed-off-by: Josh Soref <[email protected]>

* spelling: engine

Signed-off-by: Josh Soref <[email protected]>

* spelling: every time

Signed-off-by: Josh Soref <[email protected]>

* spelling: execution

Signed-off-by: Josh Soref <[email protected]>

* spelling: false positives

Signed-off-by: Josh Soref <[email protected]>

* spelling: from

Signed-off-by: Josh Soref <[email protected]>

* spelling: further

Signed-off-by: Josh Soref <[email protected]>

* spelling: github

Signed-off-by: Josh Soref <[email protected]>

* spelling: gitlab

Signed-off-by: Josh Soref <[email protected]>

* spelling: highlight

Signed-off-by: Josh Soref <[email protected]>

* spelling: hygiene

Signed-off-by: Josh Soref <[email protected]>

* spelling: ignore

Signed-off-by: Josh Soref <[email protected]>

* spelling: input

Signed-off-by: Josh Soref <[email protected]>

* spelling: item

Signed-off-by: Josh Soref <[email protected]>

* spelling: itself

Signed-off-by: Josh Soref <[email protected]>

* spelling: latestxxx

Signed-off-by: Josh Soref <[email protected]>

* spelling: navigation

Signed-off-by: Josh Soref <[email protected]>

* spelling: negative

Signed-off-by: Josh Soref <[email protected]>

* spelling: nonexistent

Signed-off-by: Josh Soref <[email protected]>

* spelling: occurred

Signed-off-by: Josh Soref <[email protected]>

* spelling: override

Signed-off-by: Josh Soref <[email protected]>

* spelling: overrides

Signed-off-by: Josh Soref <[email protected]>

* spelling: payload

Signed-off-by: Josh Soref <[email protected]>

* spelling: performed

Signed-off-by: Josh Soref <[email protected]>

* spelling: respective

Signed-off-by: Josh Soref <[email protected]>

* spelling: retrieve

Signed-off-by: Josh Soref <[email protected]>

* spelling: scanlist

Signed-off-by: Josh Soref <[email protected]>

* spelling: separated

Signed-off-by: Josh Soref <[email protected]>

* spelling: separator

Signed-off-by: Josh Soref <[email protected]>

* spelling: severity

Signed-off-by: Josh Soref <[email protected]>

* spelling: source

Signed-off-by: Josh Soref <[email protected]>

* spelling: strategy

Signed-off-by: Josh Soref <[email protected]>

* spelling: string

Signed-off-by: Josh Soref <[email protected]>

* spelling: templates

Signed-off-by: Josh Soref <[email protected]>

* spelling: terminal

Signed-off-by: Josh Soref <[email protected]>

* spelling: timeout

Signed-off-by: Josh Soref <[email protected]>

* spelling: trailing slash

Signed-off-by: Josh Soref <[email protected]>

* spelling: trailing

Signed-off-by: Josh Soref <[email protected]>

* spelling: websocket

Signed-off-by: Josh Soref <[email protected]>

---------

Signed-off-by: Josh Soref <[email protected]>
 2023-08-02 00:03:43 +05:30