Commit Graph
438 Commits
Author SHA1 Message Date
sandeep d1614857bd version update 2024-09-28 19:06:40 +04:00
Tarun Koyalwar 1f945d6d50 consider protocolType in max host error (#5668)
* consider protocolType in max host error

* add mutex when updating internal-event
2024-09-28 18:50:35 +05:30
sandeep e4dae52d5a version update 2024-09-26 12:09:13 +04:00
Dwi Siswanto c9f67897c4 fix(http): prevent addCNameIfAvailable from using closed Dialer (#5665)
added a check in `addCNameIfAvailable` to ensure
the `Dialer` isnot NIL before attempting to fetch
DNS data.

this prevents potential panics (ex. SIGSEGV) when
the `Dialer` is closed due to an interruption.

Signed-off-by: Dwi Siswanto <[email protected]>
2024-09-25 22:00:39 +05:30
Ice3man 6a561c6470 feat: clone event in clustering to generate correct failure events (#5653) 2024-09-24 18:43:35 +05:30
Dwi SiswantoandDoğan Can Bakır 9983d7415c refactor(runner): adjust max-host-error if gt concurrency (#5633)
* refactor(common): use `ParseRequestURI` instead when `NormalizeCacheValue`

also it exports the method

Signed-off-by: Dwi Siswanto <[email protected]>

* refactor(runner): adjust `max-host-error` if gt `concurrency`

Signed-off-by: Dwi Siswanto <[email protected]>

* fix lint

* chore(runner): expose adjusted `max-host-error` value

Signed-off-by: Dwi Siswanto <[email protected]>

---------

Signed-off-by: Dwi Siswanto <[email protected]>
Co-authored-by: Doğan Can Bakır <[email protected]>
2024-09-23 15:57:30 +05:30
694835c459 Add more support for fs.FS in template parsing (#5421)
* misc update

* chore(deps): bump github.com/gin-gonic/gin from 1.9.0 to 1.9.1 (#4252)

Bumps [github.com/gin-gonic/gin](https://github.com/gin-gonic/gin) from 1.9.0 to 1.9.1.
- [Release notes](https://github.com/gin-gonic/gin/releases)
- [Changelog](https://github.com/gin-gonic/gin/blob/master/CHANGELOG.md)
- [Commits](https://github.com/gin-gonic/gin/compare/v1.9.0...v1.9.1)

---
updated-dependencies:
- dependency-name: github.com/gin-gonic/gin
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump github.com/docker/docker (#4316)

Bumps [github.com/docker/docker](https://github.com/docker/docker) from 24.0.5+incompatible to 24.0.7+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v24.0.5...v24.0.7)

---
updated-dependencies:
- dependency-name: github.com/docker/docker
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix README_CN.md typos (#4369)

* version update

* Add more support for `fs.FS` in the disk catalog

This adds more support for `fs.FS` in the disk catalog.  This
fixes some places where direct `os` file-related calls were being
made to use the catalog interface instead.

Note that the JavaScript compiler *still* does not work in any
context where the `pkg/js/libs/fs` package is used.  In particular,
the `ReadFilesFromDir` function is hard-coded to use the `os`
package and not respect the catalog.

* Remove some testing artifacts

* Wrap up

* Unwind other changes

* Add a LoadHelperFileFunction to Options

* Use a direct func

* Tweak validation

* Use a function type

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: sandeep <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xc1Ym <[email protected]>
Co-authored-by: Sandeep Singh <[email protected]>
2024-09-21 02:41:22 +05:30
Ramana Reddy 3eee9678d0 fix loading dynamic auth templates on fuzzing (#5646) 2024-09-20 23:04:42 +05:30
Ramana ReddyandDoğan Can Bakır b69de15777 fix: Parse OpenApi http security schemes on empty values (#5606)
* fix: parse openapi http security schemes on empty values

* minor

---------

Co-authored-by: Doğan Can Bakır <[email protected]>
2024-09-19 19:29:19 +05:30
ghost 1610d96bc2 Auto Generate Syntax Docs + JSONSchema [Thu Sep 19 13:34:08 UTC 2024] 🤖 2024-09-19 13:34:08 +00:00
Levente Kováts 6347efa590 Clone Input when the workflow execution forks (#5621)
* clone Input when the workflow forks, add integration test

* fix line endings
2024-09-19 19:02:03 +05:30
Dwi Siswanto 4cd065df5f feat(headless): supporting standard lifecycle events (#5632)
* refactor(headless): use `WaitStable` for `waitload` action

Signed-off-by: Dwi Siswanto <[email protected]>

* feat(headless): add `getNavigationFunc`

Signed-off-by: Dwi Siswanto <[email protected]>

* feat(headless): add `WaitDOM` action

Signed-off-by: Dwi Siswanto <[email protected]>

* feat(headless): add `WaitFMP` action

Signed-off-by: Dwi Siswanto <[email protected]>

* feat(headless): add `WaitFCP` action

Signed-off-by: Dwi Siswanto <[email protected]>

* feat(headless): add `WaitIdle` action

Signed-off-by: Dwi Siswanto <[email protected]>

* refactor(headless): `ActionWaitLoad` waits for `proto.PageLifecycleEventNameLoad`

also rename `Page.WaitLoad` to `Page.WaitStable` method.

Signed-off-by: Dwi Siswanto <[email protected]>

* feat(headless): add `WaitStable` action

Signed-off-by: Dwi Siswanto <[email protected]>

* refactor(headless): supporting `duration` arg for `WaitStable` action

Signed-off-by: Dwi Siswanto <[email protected]>

* chore: ignore `*.png`

Signed-off-by: Dwi Siswanto <[email protected]>

* test(headless): update `TestActionScreenshot*`

call `ActionWaitFMP` instead of `WaitLoad` before take screenshot

Signed-off-by: Dwi Siswanto <[email protected]>

* feat(headless): chained with `Timeout` when `WaitStable`

Signed-off-by: Dwi Siswanto <[email protected]>

---------

Signed-off-by: Dwi Siswanto <[email protected]>
2024-09-19 19:01:12 +05:30
Ramana Reddy 3d2f31a56f fix missing template_url for pd signed templates when executed from custom path (#5644) 2024-09-19 18:58:20 +05:30
Tarun Koyalwar 87e99be4f6 scan error formatting (#5628) 2024-09-14 00:06:08 +05:30
Ice3man 2ac9aaf871 bugfix: fixed misc issues with linear integration (#5630) 2024-09-13 23:45:27 +05:30
Ramana Reddyandsandeep bd6330f72a feat: upload existing scan results (#5603)
* feat: upload existing scan results

* fix lint test

* misc update

---------

Co-authored-by: sandeep <[email protected]>
2024-09-12 16:13:49 +05:30
Ice3manandsandeep 59e69b561d feat: added linear issue tracker support to nuclei (#5601)
* feat: added linear issue tracker support to nuclei

* misc

* feat: fixed unmarshal issues

* added linear config

---------

Co-authored-by: sandeep <[email protected]>
2024-09-12 15:34:50 +05:30
Ramana Reddy f30d0b3b8d fix: mysql connection with special characters in password (#5604) 2024-09-06 23:49:55 +05:30
sandeep 042b33de3d version update 2024-09-02 17:38:48 +05:30
ghost cb05f55251 Auto Generate Syntax Docs + JSONSchema [Mon Sep 2 10:01:02 UTC 2024] 🤖 2024-09-02 10:01:02 +00:00
Dwi Siswanto 841d8913e5 feat(headless): add ActionWaitDialog type (#5545)
* feat(headless): add `dialog` action type

also implement it

Signed-off-by: Dwi Siswanto <[email protected]>

* refactor(headless): add `ActionData` for action output datas

Signed-off-by: Dwi Siswanto <[email protected]>

* refactor(headless): rm `value` arg for `*Page.HandleDialog`

also:
* expose `err` from \*proto.PageHandleJavaScriptDialog`
* conditional ActionData assignment based on

Signed-off-by: Dwi Siswanto <[email protected]>

* refactor(headless): rename to `ActionWaitDialog`

Signed-off-by: Dwi Siswanto <[email protected]>

* test(headless): fix mismatch assertion of `src` output of `ActionGetResource`

Signed-off-by: Dwi Siswanto <[email protected]>

* test(headless): add TestActionWaitDialog test case

Signed-off-by: Dwi Siswanto <[email protected]>

* feat(headless): add `GetActionDataWithDefault` generic func

Signed-off-by: Dwi Siswanto <[email protected]>

* feat(headless): implement `GetActionDataWithDefault`

to `header` & `status_code`

Signed-off-by: Dwi Siswanto <[email protected]>

* refactor(headless): use `mapsutil.Map` instead

Signed-off-by: Dwi Siswanto <[email protected]>

* Revert "feat(headless): add `GetActionDataWithDefault` generic func"

This reverts commit fa12e0d6a2.

---------

Signed-off-by: Dwi Siswanto <[email protected]>
2024-09-02 15:29:52 +05:30
linchizhen 88b281ae47 chore: fix some function names in comment (#5586)
Signed-off-by: linchizhen <[email protected]>
2024-09-01 14:11:01 +05:30
Dwi Siswanto e0b2542868 feat: conditionally panic-recover (#5553)
* feat: conditionally panic-recover

As discussed with @Mzack9999, we should avoid
overusing panic-recover. We need to review the RCA
first to determine whether this is an exceptional
situation or if it's a higher-level function meant
to recover from a panic. This approach will help
us establish a robust error-handling strategy.

The implementation of panic-recover should be
conditional and NOT applied when running in a CI
environment AND IS temporary. Once we've caught
all errors and made the necessary corrections, we
can remove the deferred recover function.

Signed-off-by: Dwi Siswanto <[email protected]>

* chore(deps): bump `go-ci` to v1.0.2

Signed-off-by: Dwi Siswanto <[email protected]>

* chore(make): add `-race` to `GOFLAGS` in `test`

Signed-off-by: Dwi Siswanto <[email protected]>

---------

Signed-off-by: Dwi Siswanto <[email protected]>
2024-08-28 17:57:45 +05:30
Dogan Can Bakir 6b71af448a Fixed issue with -ms option to scan non accessible host (#5576)
* fail if OnResult callback is not called

* generate error message from error logs

* try..parse..

* fix lint

* add error message to last matcher event

* fix network protocol error logging

* log returned log from ExecuteWithResults

* add back specific logging

* clean up the msg

* minor

* init integration test for -ms

* add tests for http,network,js,ws protocols

* fix lint

* fix network test

* return err for dns protocol

* add integration test for dns protocol
2024-08-28 16:27:43 +05:30
Dwi Siswanto aac1af1308 refactor(fuzz): use mapsutil.Map type (#5558)
* refactor(fuzz): use `mapsutil.Map` type

Signed-off-by: Dwi Siswanto <[email protected]>

* fix(headless): handle empty `key` in `*Value.SetParsedValue`

Signed-off-by: Dwi Siswanto <[email protected]>

* feat(fuzz): add type assertion checks

Signed-off-by: Dwi Siswanto <[email protected]>

---------

Signed-off-by: Dwi Siswanto <[email protected]>
2024-08-28 12:41:02 +05:30
Mzack9999 8e1072e2b0 Merge pull request #5551 from AdallomRoy/dev
Upgrade gitlab
2024-08-21 17:06:55 +02:00
mzack9999 bfdc507c6c lint 2024-08-21 16:34:53 +02:00
mzack9999 5e102b782b fixing race + nil crash 2024-08-21 16:09:47 +02:00
Doğan Can Bakır d1f4c98cd7 Revert "remove redundant code"
This reverts commit 35a0d673ad.
2024-08-21 15:03:41 +03:00
Roy Reznik 87c8cd8e01 Upgrade gitlab 2024-08-21 11:44:01 +01:00
Doğan Can Bakır 35a0d673ad remove redundant code 2024-08-21 11:36:33 +03:00
Doğan Can Bakır 46782ff90c use sync.Once 2024-08-21 11:26:17 +03:00
Doğan Can Bakır 7af08e2b04 Merge branch 'dev' into fix_race_condition 2024-08-19 23:06:53 +03:00
Doğan Can Bakır 3064788d35 fix race condition 2024-08-19 23:02:27 +03:00
0da993afe6 Merge commit from fork
* fix template signature verification

* fix signature pattern check

* add tests

* remove signature count constraint, check for lines len

* Add more tests

* Centralize signature extraction logic in signer package

* Move signature handling in Sign function to beginning

* Remove comment

* Revert `NewTemplateSigVerifier`

* update tests

* use ExtractSignatureAndContent func

* Allow signing code templates

* Remove unused const

---------

Co-authored-by: Doğan Can Bakır <[email protected]>
Co-authored-by: Guy Goldenberg <[email protected]>
2024-08-19 18:02:54 +05:30
Ice3manandsandeep 80b3cc0627 feat: jira accept issue-type and project ids (#5537)
* feat: jira accept issue-type and project ids

* remove validation for project name

---------

Co-authored-by: sandeep <[email protected]>
2024-08-19 06:20:12 +05:30
sandeep f2f250738c version update 2024-08-16 20:44:39 +05:30
Tarun KoyalwarandDwi Siswanto 1c76398aea lint error fixes (#5531)
* lint error fixes

* chore: satisfy non-constant format str in call lint (govet)

Signed-off-by: Dwi Siswanto <[email protected]>

---------

Signed-off-by: Dwi Siswanto <[email protected]>
Co-authored-by: Dwi Siswanto <[email protected]>
2024-08-16 20:31:23 +05:30
Tryfon Papatriantafyllou 0675aa48a3 Circular References in OpenAPI 3.0 fixed (#5491)
* Circular References in OpenAPI 3.0 fixed

* Fixing Swagger_test
2024-08-16 18:34:47 +05:30
Ramana Reddy f29b94521e fix unresolved variables in dast templates (#5443)
* fix unresolved variables in dast templates

* dedupe interactsh urls

* misc update
2024-08-16 18:19:44 +05:30
ghost d20ec34f63 Auto Generate Syntax Docs + JSONSchema [Fri Aug 16 12:41:50 UTC 2024] 🤖 2024-08-16 12:41:50 +00:00
Dwi Siswanto 1af29f97a9 feat(http): add skip-secret-file field (#5522)
* feat(http): add `BypassSecretFile` field

Signed-off-by: Dwi Siswanto <[email protected]>

* feat(http): conditionally apply auth strategies

Signed-off-by: Dwi Siswanto <[email protected]>

* refactor(http): rename `BypassSecretFile` field to `SkipSecretFile`

Signed-off-by: Dwi Siswanto <[email protected]>

---------

Signed-off-by: Dwi Siswanto <[email protected]>
2024-08-16 18:10:48 +05:30
Tryfon Papatriantafyllou c6e5bdd857 Fixing the server URL path for OpenAPI scanning (#5504)
* fix_openAPI_serverURL_path

* Issue #5503
2024-08-16 17:37:02 +05:30
Ramana ReddyandTarun Koyalwar 2f7eea410d Add team-id option (#5523)
* add team-id option

* fix dashboard url when uploading to team

---------

Co-authored-by: Tarun Koyalwar <[email protected]>
2024-08-16 13:27:26 +05:30
Ramana Reddy 2609d2d135 feat: add support for multiple auth strategies per target from secrets file (#5500) 2024-08-16 11:59:15 +05:30
Dogan Can Bakir e0466e102c redact output (#5463)
* redact output

* update regex

* redact matchet-at
2024-08-16 11:42:38 +05:30
Peter Kasza 350fa4c10c fix: FileAuthProvider stores the same strategy for each entry (#5474) 2024-08-05 15:23:21 +05:30
Tarun Koyalwar 2df1b2e88e file proto missing vars in flow & multi-protocol (#5480)
* fix missing template context in file proto

* fix file protocol missing vars

* fix test

* skip example advanced test
2024-08-04 18:14:08 +05:30
Mohammed DiaaandTarun Koyalwar ff23949bb0 Apply input transformation to multi-protocol templates (#5426)
* Apply input transformation to multi-protocol template execution

* Remove ad hoc input transoformation from DNS protocol

* Add SSL protocol input transformer

* Remove ad hoc input transoformation from SSL protocol

* Remove unused function extractDomain from the DNS protocol engine

* transform in flow as well

* bug fix + update test

* bug fix multi proto
:

* bug fix multi proto input

* bug fixes in input transform

---------

Co-authored-by: Tarun Koyalwar <[email protected]>
2024-08-01 20:43:47 +05:30
Tarun Koyalwar 38e130201e fix possible nil panic (#5473) 2024-07-31 17:34:56 +05:30