mirror of
https://github.com/projectdiscovery/nuclei.git
synced 2026-11-08 02:08:33 -10:00
Compare commits
32
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 sandeep
|
491233667d | ||
|
sandeep
|
7f556f8e33 | ||
|
sandeep
|
bce3e7f518 | ||
|
sandeep
|
5957381c02 | ||
|
sandeep
|
3f82fc6d00 | ||
|
sandeep
|
4d12271ccf | ||
|
Sandeep Singh
|
39b6ca9bb7 | ||
|
Sandeep Singh
|
9957003113 | ||
|
sandeep
|
930f51fcf0 | ||
|
sandeep
|
af2284b741 | ||
|
Sandeep Singh
|
cda1fc0ba5 | ||
|
sandeep
|
0f4ad124e4 | ||
|
sandeep
|
7d031d9833 | ||
|
sandeep
|
669eee24bd | ||
|
sandeep
|
1f38d6b459 | ||
|
sandeep
|
b38bcdfd81 | ||
|
sandeep
|
7f2558fc12 | ||
|
sandeep
|
5eac841424 | ||
|
sandeep
|
c3b39be605 | ||
|
sandeep
|
6072a2fcee | ||
|
sandeep
|
2a7e15ddfa | ||
|
sandeep
|
3a7a073d52 | ||
|
sandeep
|
918b62bd35 | ||
|
sandeep
|
106ab84259 | ||
|
sandeep
|
85d888b01a | ||
|
Xc1Ym
|
9f18a99db7 | ||
|
sandeep
|
9606591dc9 | ||
|
dependabot[bot]
|
19567fb77b | ||
|
sandeep
|
2d14849674 | ||
|
sandeep
|
cc46f57d4d | ||
|
dependabot[bot]
|
75357b1eea | ||
|
sandeep
|
5aa929ac7f |
No files matched your search
@@ -21,7 +21,7 @@ jobs:
|
||||
|
||||
- uses: goreleaser/goreleaser-action@v4
|
||||
with:
|
||||
args: "release --clean"
|
||||
args: "release --rm-dist"
|
||||
version: latest
|
||||
env:
|
||||
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
||||
|
||||
@@ -30,10 +30,7 @@
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README.md">English</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_CN.md">中文</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_KR.md">Korean</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ID.md">Indonesia</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ES.md">Spanish</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_JP.md">日本語</a>
|
||||
</p>
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ID.md">Indonesia</a>
|
||||
</p>
|
||||
|
||||
---
|
||||
@@ -182,8 +179,6 @@ OUTPUT:
|
||||
|
||||
CONFIGURATIONS:
|
||||
-config string path to the nuclei configuration file
|
||||
-tp, -profile string template profile config file to run
|
||||
-tpl, -profile-list list community template profiles
|
||||
-fr, -follow-redirects enable following redirects for http templates
|
||||
-fhr, -follow-host-redirects follow redirects on the same host
|
||||
-mr, -max-redirects int max number of redirects to follow for http templates (default 10)
|
||||
@@ -210,12 +205,10 @@ CONFIGURATIONS:
|
||||
-i, -interface string network interface to use for network scan
|
||||
-at, -attack-type string type of payload combinations to perform (batteringram,pitchfork,clusterbomb)
|
||||
-sip, -source-ip string source ip address to use for network scan
|
||||
-rsr, -response-size-read int max response size to read in bytes
|
||||
-rsr, -response-size-read int max response size to read in bytes (default 10485760)
|
||||
-rss, -response-size-save int max response size to read in bytes (default 1048576)
|
||||
-rrt, -response-read-timeout value response read timeout in seconds (default 5s)
|
||||
-reset reset removes all nuclei configuration and data files (including nuclei-templates)
|
||||
-tlsi, -tls-impersonate enable experimental client hello (ja3) tls randomization
|
||||
-hae, -http-api-endpoint string experimental http api endpoint
|
||||
|
||||
INTERACTSH:
|
||||
-iserver, -interactsh-server string interactsh server url for self-hosted instance (default: oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me)
|
||||
@@ -227,13 +220,10 @@ INTERACTSH:
|
||||
-ni, -no-interactsh disable interactsh server for OAST testing, exclude OAST based templates
|
||||
|
||||
FUZZING:
|
||||
-ft, -fuzzing-type string overrides fuzzing type set in template (replace, prefix, postfix, infix)
|
||||
-fm, -fuzzing-mode string overrides fuzzing mode set in template (multiple, single)
|
||||
-fuzz enable loading fuzzing templates (Deprecated: use -dast instead)
|
||||
-dast enable / run dast (fuzz) nuclei templates
|
||||
-dfp, -display-fuzz-points display fuzz points in the output for debugging
|
||||
-fuzz-param-frequency int frequency of uninteresting parameters for fuzzing before skipping (default 10)
|
||||
-fa, -fuzz-aggression string fuzzing aggression level controls payload count for fuzz (low, medium, high) (default "low")
|
||||
-ft, -fuzzing-type string overrides fuzzing type set in template (replace, prefix, postfix, infix)
|
||||
-fm, -fuzzing-mode string overrides fuzzing mode set in template (multiple, single)
|
||||
-fuzz enable loading fuzzing templates (Deprecated: use -dast instead)
|
||||
-dast only run DAST templates
|
||||
|
||||
UNCOVER:
|
||||
-uc, -uncover enable uncover engine
|
||||
@@ -245,15 +235,13 @@ UNCOVER:
|
||||
|
||||
RATE-LIMIT:
|
||||
-rl, -rate-limit int maximum number of requests to send per second (default 150)
|
||||
-rld, -rate-limit-duration value maximum number of requests to send per second (default 1s)
|
||||
-rlm, -rate-limit-minute int maximum number of requests to send per minute (DEPRECATED)
|
||||
-rlm, -rate-limit-minute int maximum number of requests to send per minute
|
||||
-bs, -bulk-size int maximum number of hosts to be analyzed in parallel per template (default 25)
|
||||
-c, -concurrency int maximum number of templates to be executed in parallel (default 25)
|
||||
-hbs, -headless-bulk-size int maximum number of headless hosts to be analyzed in parallel per template (default 10)
|
||||
-headc, -headless-concurrency int maximum number of headless templates to be executed in parallel (default 10)
|
||||
-jsc, -js-concurrency int maximum number of javascript runtimes to be executed in parallel (default 120)
|
||||
-pc, -payload-concurrency int max payload concurrency for each template (default 25)
|
||||
-prc, -probe-concurrency int http probe concurrency with httpx (default 50)
|
||||
|
||||
OPTIMIZATIONS:
|
||||
-timeout int time to wait in seconds before timeout (default 10)
|
||||
|
||||
+1
-2
@@ -32,8 +32,7 @@
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README.md">English</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_CN.md">中文</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_KR.md">Korean</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ID.md">Indonesia</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ES.md">Spanish</a>
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ID.md">Indonesia</a>
|
||||
</p>
|
||||
|
||||
---
|
||||
|
||||
-369
@@ -1,369 +0,0 @@
|
||||
<h1 align="center">
|
||||
<br>
|
||||
<a href="https://nuclei.projectdiscovery.io"><img src="static/nuclei-logo.png" width="200px" alt="Nuclei"></a>
|
||||
</h1>
|
||||
|
||||
<h4 align="center">Escáner de vulnerabilidades rápido y personalizable basado en un sencillo DSL basado en YAML.</h4>
|
||||
|
||||
|
||||
<p align="center">
|
||||
<img src="https://img.shields.io/github/go-mod/go-version/projectdiscovery/nuclei">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/releases"><img src="https://img.shields.io/github/downloads/projectdiscovery/nuclei/total">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/graphs/contributors"><img src="https://img.shields.io/github/contributors-anon/projectdiscovery/nuclei">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/releases/"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/issues"><img src="https://img.shields.io/github/issues-raw/projectdiscovery/nuclei">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/discussions"><img src="https://img.shields.io/github/discussions/projectdiscovery/nuclei">
|
||||
<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
|
||||
<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
<a href="#how-it-works">Cómo funciona</a> •
|
||||
<a href="#install-nuclei">Instalación</a> •
|
||||
<a href="https://docs.projectdiscovery.io/tools/nuclei/">Documentación</a> •
|
||||
<a href="#credits">Créditos</a> •
|
||||
<a href="https://docs.projectdiscovery.io/tools/nuclei/faq">Preguntas Frecuentes</a> •
|
||||
<a href="https://discord.gg/projectdiscovery">Únete a Discord</a>
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README.md">English</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_CN.md">中文</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_KR.md">Korean</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ID.md">Indonesia</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ES.md">Spanish</a>
|
||||
</p>
|
||||
|
||||
---
|
||||
|
||||
Nuclei se utiliza para enviar peticiones a múltiples objetivos basándose en una plantilla, lo que resulta en cero falsos positivos y proporciona un escaneo rápido en un gran número de hosts. Nuclei ofrece escaneos para una variedad de protocolos, incluyendo TCP, DNS, HTTP, SSL, File, Whois, Websocket, Headless, Code, etc. Con plantillas potentes y flexibles, Nuclei puede utilizarse para modelar todo tipo de comprobaciones de seguridad.
|
||||
|
||||
Tenemos un [repositorio dedicado](https://github.com/projectdiscovery/nuclei-templates) que alberga varios tipos de plantillas de vulnerabilidades, contribuidas por **más de 300** investigadores y ingenieros de seguridad.
|
||||
|
||||
## Cómo funciona
|
||||
|
||||
|
||||
<h3 align="center">
|
||||
<img src="static/nuclei-flow.jpg" alt="nuclei-flow" width="700px"></a>
|
||||
</h3>
|
||||
|
||||
|
||||
| :exclamation: **Descargo de responsabilidad** |
|
||||
|---------------------------------|
|
||||
| **Este proyecto está en desarrollo activo**. Es de esperar que se produzcan cambios importantes con las nuevas versiones. Consulte el registro de cambios de la versión antes de actualizar. |
|
||||
| Este proyecto fue principalmente desarrollado para ser utilizado como una herramienta CLI independiente. **Ejecutar nuclei como un servicio puede suponer riesgos de seguridad.** Se recomienda utilizarlo con precaución y tomar medidas de seguridad adicionales. |
|
||||
|
||||
# Instalación de Nuclei
|
||||
|
||||
Nuclei requiere **go1.21** para instalarse correctamente. Ejecute el siguiente comando para instalar la última versión -
|
||||
|
||||
```sh
|
||||
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
|
||||
```
|
||||
|
||||
<details>
|
||||
<summary>Brew</summary>
|
||||
|
||||
```sh
|
||||
brew install nuclei
|
||||
```
|
||||
|
||||
</details>
|
||||
<details>
|
||||
<summary>Docker</summary>
|
||||
|
||||
```sh
|
||||
docker pull projectdiscovery/nuclei:latest
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
**Más métodos de instalación [pueden encontrarse aquí](https://docs.projectdiscovery.io/tools/nuclei/install).**
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
### Plantillas de Nuclei
|
||||
|
||||
Nuclei cuenta con soporte incorporado para la descarga/actualización automática de plantillas desde la versión [v2.5.2](https://github.com/projectdiscovery/nuclei/releases/tag/v2.5.2) en adelante. El proyecto [**Nuclei-Templates**](https://github.com/projectdiscovery/nuclei-templates) proporciona una lista de plantillas listas para usar, aportadas por la comunidad, y que se actualizan constantemente.
|
||||
|
||||
También puedes utilizar la bandera `update-templates` para actualizar las plantillas de Nuclei en cualquier momento; puedes escribir tus propias pruebas para tu flujo de trabajo y necesidades individuales siguiendo la [guía de plantillas](https://docs.projectdiscovery.io/templates/) de Nuclei.
|
||||
|
||||
La sintaxis de referencia YAML DSL está disponible [aquí](SYNTAX-REFERENCE.md).
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
### Uso
|
||||
|
||||
```sh
|
||||
nuclei -h
|
||||
```
|
||||
|
||||
Esto mostrará ayuda sobre la herramienta. Aquí están todas las opciones que soporta.
|
||||
|
||||
|
||||
```console
|
||||
Nuclei es un escáner de vulnerabilidades rápido y basado en plantillas
|
||||
que se centra en su amplia configurabilidad, extensibilidad y facilidad de uso.
|
||||
|
||||
Usage:
|
||||
./nuclei [flags]
|
||||
|
||||
Flags:
|
||||
TARGET:
|
||||
-u, -target string[] URLs/hosts a escanear
|
||||
-l, -list string ruta al archivo que contiene la lista de URLs/hosts a escanear (uno por línea)
|
||||
-eh, -exclude-hosts string[] hosts a excluir para escanear de la lista de entrada (ip, cidr, hostname)
|
||||
-resume string reanudar el escaneo usando resume.cfg (la clusterización quedará inhabilitada)
|
||||
-sa, -scan-all-ips escanear todas las IP asociadas al registro dns
|
||||
-iv, -ip-version string[] versión IP a escanear del nombre de host (4,6) - (por defecto 4)
|
||||
|
||||
TARGET-FORMAT:
|
||||
-im, -input-mode string modo del archivo de entrada (list, burp, jsonl, yaml, openapi, swagger) (por defecto "list")
|
||||
-ro, -required-only utilizar solo campos requeridos en el formato de entrada al generar peticiones
|
||||
-sfv, -skip-format-validation saltar la validación de formato (como variables faltantes) al procesar el archivo de entrada
|
||||
|
||||
TEMPLATES:
|
||||
-nt, -new-templates ejecutar sólo las nuevas plantillas añadidas en la última versión de nuclei-templates
|
||||
-ntv, -new-templates-version string[] ejecutar las nuevas plantillas añadidas en la versión especificada
|
||||
-as, -automatic-scan escaneo web automático utilizando la detección de tecnología de wappalyzer para mapeo de etiquetas
|
||||
-t, -templates string[] lista de plantillas o directorio de plantillas a ejecutar (separadas por comas, file)
|
||||
-turl, -template-url string[] url de plantilla o lista que contiene urls de plantillas a ejecutar (separadas por comas, file)
|
||||
-w, -workflows string[] lista de flujos de trabajo o directorio de flujos de trabajo a ejecutar (separadas por comas, file)
|
||||
-wurl, -workflow-url string[] url de flujo de trabajo o lista que contiene urls de flujo de trabajo para ejecutar (separadas por comas, file)
|
||||
-validate valida las plantillas pasadas a nuclei
|
||||
-nss, -no-strict-syntax deshabilita la comprobación de sintaxis estricta en las plantillas
|
||||
-td, -template-display muestra el contenido de las plantillas
|
||||
-tl lista todas las plantillas disponibles
|
||||
-tgl lista todas las etiquetas disponibles
|
||||
-sign firma las plantillas con la clave privada definida en la variable de entorno NUCLEI_SIGNATURE_PRIVATE_KEY
|
||||
-code habilita la carga de plantillas basadas en protocolos de código
|
||||
-dut, -disable-unsigned-templates deshabilita la ejecución de plantillas no firmadas o plantillas con firma no coincidente
|
||||
|
||||
FILTERING:
|
||||
-a, -author string[] plantillas a ejecutar basadas en autores (separadas por comas, file)
|
||||
-tags string[] plantillas a ejecutar basadas en etiquetas (separadas por comas, file)
|
||||
-etags, -exclude-tags string[] plantillas a excluir basadas en etiquetas (separadas por comas, file)
|
||||
-itags, -include-tags string[] etiquetas a ejecutar incluso si están excluidas ya sea por defecto o por configuración
|
||||
-id, -template-id string[] plantillas a ejecutar basadas en IDs de plantilla (comma-separated, file, allow-wildcard)
|
||||
-eid, -exclude-id string[] plantillas a excluir basadas en IDs de plantilla (separadas por comas, file)
|
||||
-it, -include-templates string[] ruta al archivo de plantilla o directorio a ejecutar incluso si están excluidas ya sea por defecto o por configuración
|
||||
-et, -exclude-templates string[] ruta al archivo de plantilla o directorio a excluir (separadas por comas, file)
|
||||
-em, -exclude-matchers string[] matchers de plantilla a excluir en el resultado
|
||||
-s, -severity value[] plantillas a ejecutar basadas en criticidad. Valores posibles: info, bajo, medio, alto, crítico, desconocido
|
||||
-es, -exclude-severity value[] plantillas a excluir basadas en criticidad. Valores posibles: info, bajo, medio, alto, crítico, desconocido
|
||||
-pt, -type value[] plantillas a ejecutar basadas en tipo de protocolo. Valores posibles: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript
|
||||
-ept, -exclude-type value[] plantillas a excluir basadas en tipo de protocolo. Valores posibles: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript
|
||||
-tc, -template-condition string[] plantillas a ejecutar basadas en condición de expresión
|
||||
|
||||
OUTPUT:
|
||||
-o, -output string archivo de salida donde guardar las incidencias/vulnerabilidades detectadas
|
||||
-sresp, -store-resp almacenar todas las peticiones/respuestas enviadas por nuclei en el directorio de salida
|
||||
-srd, -store-resp-dir string almacenar todas las peticiones/respuestas enviadas por nuclei en un directorio personalizado (por defecto "output")
|
||||
-silent mostrar resultados únicamente
|
||||
-nc, -no-color deshabilitar la coloración del contenido de salida (códigos de escape ANSI)
|
||||
-j, -jsonl escribir la salida en formato JSONL(ines)
|
||||
-irr, -include-rr -omit-raw incluir pares peticiones/respuesta en las salidas JSON, JSONL y Markdown (sólo para hallazgos) [OBSOLETO usar -omit-raw] (por defecto true)
|
||||
-or, -omit-raw omitir los pares peticiones/respuesta en las salidas JSON, JSONL y Markdown (sólo para hallazgos)
|
||||
-ot, -omit-template omitir plantilla codificada en la salida JSON, JSONL
|
||||
-nm, -no-meta deshabilitar la impresión de metadatos de resultados en la salida cli
|
||||
-ts, -timestamp habilitar la impresión de la marca de tiempo en la salida cli
|
||||
-rdb, -report-db string base de datos de informes de nuclei (utilizarla siempre para persistir los datos de los informes)
|
||||
-ms, -matcher-status mostrar el estado de fallo de coincidencia
|
||||
-me, -markdown-export string directorio para exportar resultados en formato markdown
|
||||
-se, -sarif-export string archivo para exportar resultados en formato SARIF
|
||||
-je, -json-export string archivo para exportar resultados en formato JSON
|
||||
-jle, -jsonl-export string archivo para exportar resultados en formato JSONL(ines)
|
||||
|
||||
CONFIGURATIONS:
|
||||
-config string ruta al archivo de configuración de nuclei
|
||||
-fr, -follow-redirects habilitar el seguimiento de redirecciones para plantillas http
|
||||
-fhr, -follow-host-redirects seguir redirecciones en el mismo host
|
||||
-mr, -max-redirects int número máximo de redirecciones a seguir para plantillas http (por defecto 10)
|
||||
-dr, -disable-redirects deshabilitar redirecciones para plantillas http
|
||||
-rc, -report-config string archivo de configuración del módulo de informes de nuclei
|
||||
-H, -header string[] encabezado/cookie personalizado a incluir en todas las peticiones http en formato header:value (cli, file)
|
||||
-V, -var value variables personalizadas en formato key=value
|
||||
-r, -resolvers string archivo que contiene lista de resolutores para nuclei
|
||||
-sr, -system-resolvers utilizar resolución de DNS del sistema como fallback de error
|
||||
-dc, -disable-clustering deshabilitar la clusterización de peticiones
|
||||
-passive habilitar el modo de procesamiento pasivo de respuestas HTTP
|
||||
-fh2, -force-http2 forzar la conexión http2 en las peticiones
|
||||
-ev, -env-vars habilitar el uso de variables de entorno en la plantilla
|
||||
-cc, -client-cert string archivo de certificado de cliente (codificado en PEM) utilizado para autenticarse contra los hosts escaneados
|
||||
-ck, -client-key string archivo de clave de cliente (codificado en PEM) utilizado para autenticarse contra los hosts escaneados
|
||||
-ca, -client-ca string archivo de autoridad de certificación de cliente (codificado en PEM) utilizado para autenticarse contra los hosts escaneados
|
||||
-sml, -show-match-line mostrar líneas de coincidencia para plantillas de archivo, funciona solo con extractores
|
||||
-ztls utilizar la biblioteca ztls con autofallback a estándar para tls13 [Obsoleto] autofallback a ztls está habilitado por defecto
|
||||
-sni string nombre de host tls sni a usar (por defecto: nombre de dominio de entrada)
|
||||
-dt, -dialer-timeout value tiempo de espera para peticiones de red
|
||||
-dka, -dialer-keep-alive value duración de keep-alive para peticiones de red
|
||||
-lfa, -allow-local-file-access permite el acceso a archivos (carga útil) en cualquier lugar del sistema
|
||||
-lna, -restrict-local-network-access bloquea conexiones a la red local / privada
|
||||
-i, -interface string interfaz de red a usar para el escaneo de red
|
||||
-at, -attack-type string tipo de combinaciones de carga útil a realizar (batteringram, pitchfork, clusterbomb)
|
||||
-sip, -source-ip string dirección ip de origen a usar para el escaneo de red
|
||||
-rsr, -response-size-read int tamaño máximo de respuesta a leer en bytes (por defecto 10485760)
|
||||
-rss, -response-size-save int tamaño máximo de respuesta a guardar en bytes (por defecto 1048576)
|
||||
-reset reset elimina todos los archivos de configuración y datos de nuclei (incluidas las nuclei-templates)
|
||||
-tlsi, -tls-impersonate habilitar client hello (ja3) tls randomization experimental
|
||||
|
||||
INTERACTSH:
|
||||
-iserver, -interactsh-server string url del servidor interactsh para instancia autoalojada (por defecto: oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me)
|
||||
-itoken, -interactsh-token string token de autenticación del servidor interactsh autoalojado
|
||||
-interactions-cache-size int número de peticiones a mantener en la caché de interacciones (por defecto 5000)
|
||||
-interactions-eviction int número de segundos a esperar antes de eliminar las solicitudes de la caché (por defecto 60)
|
||||
-interactions-poll-duration int número de segundos a esperar antes de cada solicitud de polling de interacciones (por defecto 5)
|
||||
-interactions-cooldown-period int tiempo adicional para el polling de interacciones antes de salir (por defecto 5)
|
||||
-ni, -no-interactsh desactivar el servidor interactsh para pruebas OAST, excluir plantillas basadas en OAST
|
||||
|
||||
FUZZING:
|
||||
-ft, -fuzzing-type string sobrescribe el tipo de fuzzing establecido en la plantilla (replace, prefix, postfix, infix)
|
||||
-fm, -fuzzing-mode string sobrescribe el modo de fuzzing establecido en la plantilla (multiple, single)
|
||||
-fuzz habilita la carga de plantillas de fuzzing (Obsoleto: usar -dast en su lugar)
|
||||
-dast solo ejecuta plantillas DAST
|
||||
|
||||
UNCOVER:
|
||||
-uc, -uncover habilita el motor uncover
|
||||
-uq, -uncover-query string[] consulta de búsqueda uncover
|
||||
-ue, -uncover-engine string[] motor de búsqueda uncover (shodan,censys,fofa,shodan-idb,quake,hunter,zoomeye,netlas,criminalip,publicwww,hunterhow) (por defecto shodan)
|
||||
-uf, -uncover-field string campos uncover a devolver (ip,port,host) (por defecto "ip:port")
|
||||
-ul, -uncover-limit int resultados uncover a devolver (por defecto 100)
|
||||
-ur, -uncover-ratelimit int sobrescribe el límite de velocidad de los motores con el límite de velocidad del motor uncover (por defecto 60 req/min) (por defecto 60)
|
||||
|
||||
RATE-LIMIT:
|
||||
-rl, -rate-limit int número máximo de peticiones a enviar por segundo (por defecto 150)
|
||||
-rlm, -rate-limit-minute int número máximo de peticiones a enviar por minuto
|
||||
-bs, -bulk-size int número máximo de hosts a ser analizados en paralelo por plantilla (por defecto 25)
|
||||
-c, -concurrency int número máximo de plantillas a ejecutar en paralelo (por defecto 25)
|
||||
-hbs, -headless-bulk-size int número máximo de hosts headless a ser analizados en paralelo por plantilla (por defecto 10)
|
||||
-headc, -headless-concurrency int número máximo de plantillas headless a ejecutar en paralelo (por defecto 10)
|
||||
-jsc, -js-concurrency int número máximo de entornos de ejecución de JavaScript a ejecutar en paralelo (por defecto 120)
|
||||
-pc, -payload-concurrency int concurrencia máxima de carga útil para cada plantilla (por defecto 25)
|
||||
|
||||
OPTIMIZATIONS:
|
||||
-timeout int tiempo de espera en segundos (por defecto 10)
|
||||
-retries int número de veces que se reintenta una petición fallida (por defecto 1)
|
||||
-ldp, -leave-default-ports dejar puertos HTTP/HTTPS predeterminados (por ejemplo, host:80,host:443)
|
||||
-mhe, -max-host-error int errores máximos para un host antes de omitirlo del escaneo (por defecto 30)
|
||||
-te, -track-error string[] agrega el error dado a la lista de seguimiento de errores máximos por host (standard, file)
|
||||
-nmhe, -no-mhe deshabilita la omisión del host del escaneo basado en errores
|
||||
-project utiliza una carpeta de proyecto para evitar enviar la misma petición varias veces
|
||||
-project-path string establece una ruta de proyecto específica (por defecto "/tmp")
|
||||
-spm, -stop-at-first-match detiene el procesamiento de las peticiones HTTP después de la primera coincidencia (puede romper la lógica de la plantilla/flujo de trabajo)
|
||||
-stream modo transmisión - comienza a trabajar sin ordenar la entrada
|
||||
-ss, -scan-strategy value estrategia a utilizar mientras se escanea (auto/host-spray/template-spray) (por defecto auto)
|
||||
-irt, -input-read-timeout value tiempo de espera en la lectura de entrada (por defecto 3m0s)
|
||||
-nh, -no-httpx deshabilita análisis httpx para entradas que no son URL
|
||||
-no-stdin deshabilita el procesamiento de la entrada estándar
|
||||
|
||||
HEADLESS:
|
||||
-headless habilita las plantillas que requieren soporte de navegadores sin interfaz gráfica (headless browser) (el usuario root en Linux deshabilitará el sandbox)
|
||||
-page-timeout int segundos para esperar cada página en modo sin interfaz (por defecto 20)
|
||||
-sb, -show-browser muestra el navegador en la pantalla al ejecutar plantillas con modo sin interfaz
|
||||
-ho, -headless-options string[] inicia Chrome en modo sin interfaz con opciones adicionales
|
||||
-sc, -system-chrome utiliza el navegador Chrome instalado localmente en lugar del instalado por nuclei
|
||||
-lha, -list-headless-action lista de acciones sin interfaz disponibles
|
||||
|
||||
DEBUG:
|
||||
-debug muestra todas las peticiones y respuestas
|
||||
-dreq, -debug-req muestra todas las peticiones enviadas
|
||||
-dresp, -debug-resp muestra todas las respuestas recibidas
|
||||
-p, -proxy string[] lista de proxies http/socks5 a utilizar (separados por comas o archivo de entrada)
|
||||
-pi, -proxy-internal proxy para todas las peticiones internas
|
||||
-ldf, -list-dsl-function lista todas las firmas de función DSL admitidas
|
||||
-tlog, -trace-log string archivo a escribir el registro de traza de peticiones enviadas
|
||||
-elog, -error-log string archivo a escribir el registro de error de peticiones enviadas
|
||||
-version muestra la versión de nuclei
|
||||
-hm, -hang-monitor habilita la monitorización de bloqueos de nuclei
|
||||
-v, -verbose muestra salida detallada
|
||||
-profile-mem string archivo opcional de volcado de memoria de nuclei
|
||||
-vv muestra las plantillas cargadas para el escaneo
|
||||
-svd, -show-var-dump muestra el volcado de variables para depuración
|
||||
-ep, -enable-pprof habilita el servidor de depuración pprof
|
||||
-tv, -templates-version muestra la versión de las plantillas nuclei (nuclei-templates) instaladas
|
||||
-hc, -health-check ejecuta comprobación de diagnóstico
|
||||
|
||||
UPDATE:
|
||||
-up, -update actualiza el motor de nuclei a la última versión lanzada
|
||||
-ut, -update-templates actualiza nuclei-templates a la última versión lanzada
|
||||
-ud, -update-template-dir string directorio personalizado para instalar/actualizar nuclei-templates
|
||||
-duc, -disable-update-check deshabilita la comprobación automática de actualizaciones de nuclei/templates
|
||||
|
||||
STATISTICS:
|
||||
-stats muestra estadísticas sobre el escaneo en ejecución
|
||||
-sj, -stats-json muestra estadísticas en formato JSONL(ines)
|
||||
-si, -stats-interval int número de segundos a esperar entre mostrar una actualización de estadísticas (por defecto 5)
|
||||
-mp, -metrics-port int puerto para exponer métricas de nuclei (por defecto 9092)
|
||||
|
||||
CLOUD:
|
||||
-auth configura la clave de API del cloud de projectdiscovery (pdcp)
|
||||
-cup, -cloud-upload sube los resultados del escaneo al dashboard de pdcp
|
||||
-sid, -scan-id string sube los resultados del escaneo al ID de escaneo dado
|
||||
|
||||
AUTHENTICATION:
|
||||
-sf, -secret-file string[] ruta al archivo de configuración que contiene los secrets para el escaneo autenticado de nuclei
|
||||
-ps, -prefetch-secrets precarga los secrets del archivo de secrets
|
||||
|
||||
|
||||
EXAMPLES:
|
||||
Ejecutar nuclei en un solo host:
|
||||
$ nuclei -target example.com
|
||||
|
||||
Ejecutar nuclei con directorios de plantillas específicos:
|
||||
$ nuclei -target example.com -t http/cves/ -t ssl
|
||||
|
||||
Ejecutar nuclei contra una lista de hosts:
|
||||
$ nuclei -list hosts.txt
|
||||
|
||||
Ejecutar nuclei con una salida JSON:
|
||||
$ nuclei -target example.com -json-export output.json
|
||||
|
||||
Ejecutar nuclei con salidas Markdown ordenadas (con variables de entorno):
|
||||
$ MARKDOWN_EXPORT_SORT_MODE=template nuclei -target example.com -markdown-export nuclei_report/
|
||||
|
||||
Documentación adicional disponible en: https://docs.nuclei.sh/getting-started/running
|
||||
```
|
||||
|
||||
### Ejecutando Nuclei
|
||||
|
||||
Consulta https://docs.projectdiscovery.io/tools/nuclei/running para obtener detalles sobre cómo ejecutar Nuclei.
|
||||
|
||||
### Uso de Nuclei desde código Go
|
||||
|
||||
La guía completa sobre cómo usar Nuclei como biblioteca/SDK está disponible en [godoc](https://pkg.go.dev/github.com/projectdiscovery/nuclei/v3/lib#section-readme).
|
||||
|
||||
|
||||
### Recursos
|
||||
|
||||
Puedes acceder a la documentación principal de Nuclei en https://docs.projectdiscovery.io/tools/nuclei/, y obtener más información sobre Nuclei en la nube con [ProjectDiscovery Cloud Platform](https://cloud.projectdiscovery.io).
|
||||
|
||||
¡Consulta https://docs.projectdiscovery.io/tools/nuclei/resources para obtener más recursos y videos sobre Nuclei!
|
||||
|
||||
### Créditos
|
||||
|
||||
Gracias a todos los increíbles [contribuyentes de la comunidad que enviaron PRs](https://github.com/projectdiscovery/nuclei/graphs/contributors) y mantienen este proyecto actualizado. :heart:
|
||||
|
||||
Si tienes una idea o algún tipo de mejora, eres bienvenido a contribuir y participar en el Proyecto, siéntete libre de enviar tu PR.
|
||||
|
||||
<p align="center">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/graphs/contributors">
|
||||
<img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei&max=500">
|
||||
</a>
|
||||
</p>
|
||||
|
||||
|
||||
También echa un vistazo a los siguientes proyectos de código abierto similares que pueden adaptarse a tu flujo de trabajo:
|
||||
|
||||
[FFuF](https://github.com/ffuf/ffuf), [Qsfuzz](https://github.com/ameenmaali/qsfuzz), [Inception](https://github.com/proabiral/inception), [Snallygaster](https://github.com/hannob/snallygaster), [Gofingerprint](https://github.com/Static-Flow/gofingerprint), [Sn1per](https://github.com/1N3/Sn1per/tree/master/templates), [Google tsunami](https://github.com/google/tsunami-security-scanner), [Jaeles](https://github.com/jaeles-project/jaeles), [ChopChop](https://github.com/michelin/ChopChop)
|
||||
|
||||
### Licencia
|
||||
|
||||
Nuclei se distribuye bajo la [Licencia MIT](https://github.com/projectdiscovery/nuclei/blob/main/LICENSE.md)
|
||||
|
||||
<h1 align="left">
|
||||
<a href="https://discord.gg/projectdiscovery"><img src="static/Join-Discord.png" width="380" alt="Join Discord"></a> <a href="https://docs.projectdiscovery.io"><img src="static/check-nuclei-documentation.png" width="380" alt="Check Nuclei Documentation"></a>
|
||||
</h1>
|
||||
+1
-2
@@ -32,8 +32,7 @@
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README.md">English</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_CN.md">中文</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_KR.md">Korean</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ID.md">Indonesia</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ES.md">Spanish</a>
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ID.md">Indonesia</a>
|
||||
</p>
|
||||
|
||||
---
|
||||
|
||||
-172
@@ -1,172 +0,0 @@
|
||||
<h1 align="center">
|
||||
<br>
|
||||
<a href="https://nuclei.projectdiscovery.io"><img src="static/nuclei-logo.png" width="200px" alt="Nuclei"></a>
|
||||
</h1>
|
||||
|
||||
<h4 align="center">シンプルなYAMLベースのDSLに基づいた高速でカスタマイズ可能な脆弱性スキャナー</h4>
|
||||
|
||||
<p align="center">
|
||||
<img src="https://img.shields.io/github/go-mod/go-version/projectdiscovery/nuclei">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/releases"><img src="https://img.shields.io/github/downloads/projectdiscovery/nuclei/total">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/graphs/contributors"><img src="https://img.shields.io/github/contributors-anon/projectdiscovery/nuclei">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/releases/"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/issues"><img src="https://img.shields.io/github/issues-raw/projectdiscovery/nuclei">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/discussions"><img src="https://img.shields.io/github/discussions/projectdiscovery/nuclei">
|
||||
<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
|
||||
<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
<a href="#how-it-works">動作原理</a> •
|
||||
<a href="#install-nuclei">インストール</a> •
|
||||
<a href="https://docs.projectdiscovery.io/tools/nuclei/">ドキュメント</a> •
|
||||
<a href="#credits">クレジット</a> •
|
||||
<a href="https://docs.projectdiscovery.io/tools/nuclei/faq">FAQ</a> •
|
||||
<a href="https://discord.gg/projectdiscovery">Discordに参加</a>
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README.md">英語</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_CN.md">中国語</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_KR.md">韓国語</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ID.md">インドネシア語</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ES.md">スペイン語</a>
|
||||
</p>
|
||||
|
||||
---
|
||||
|
||||
Nucleiは、テンプレートに基づいてターゲット間でリクエストを送信するために使用され、偽陽性がゼロであり、多数のホストで高速なスキャンを提供します。Nucleiは、TCP、DNS、HTTP、SSL、ファイル、Whois、Websocket、Headless、Codeなど、さまざまなプロトコルのスキャンを提供します。強力で柔軟なテンプレートを使用して、Nucleiはすべての種類のセキュリティチェックをモデル化するために使用できます。
|
||||
|
||||
**300人以上の** セキュリティ研究者およびエンジニアが提供するさまざまなタイプの脆弱性テンプレートを収容する[専用リポジトリ](https://github.com/projectdiscovery/nuclei-templates)を持っています。
|
||||
|
||||
## 動作原理
|
||||
|
||||
<h3 align="center">
|
||||
<img src="static/nuclei-flow.jpg" alt="nuclei-flow" width="700px"></a>
|
||||
</h3>
|
||||
|
||||
| :exclamation: **免責事項** |
|
||||
|---------------------------------|
|
||||
| **このプロジェクトは積極的に開発されています**。リリースによって重大な変更が発生することがあります。更新する前にリリースの変更ログを確認してください。 |
|
||||
| このプロジェクトは主にスタンドアロンのCLIツールとして使用されることを目的として構築されました。**Nucleiをサービスとして実行すると、セキュリティリスクが生じる可能性があります。**注意して使用し、追加のセキュリティ対策を講じることをお勧めします。 |
|
||||
|
||||
# Nucleiのインストール
|
||||
|
||||
Nucleiを正常にインストールするには、**go1.21**が必要です。以下のコマンドを実行して最新バージョンをインストールしてください -
|
||||
|
||||
```sh
|
||||
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
|
||||
```
|
||||
|
||||
<details>
|
||||
<summary>Brew</summary>
|
||||
|
||||
```sh
|
||||
brew install nuclei
|
||||
```
|
||||
|
||||
</details>
|
||||
<details>
|
||||
<summary>Docker</summary>
|
||||
|
||||
```sh
|
||||
docker pull projectdiscovery/nuclei:latest
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
**より多くのインストール方法は[こちら](https://docs.projectdiscovery.io/tools/nuclei/install)で見つけることができます。**
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td>
|
||||
|
||||
### Nucleiテンプレート
|
||||
|
||||
Nucleiは、バージョン[v2.5.2](https://github.com/projectdiscovery/nuclei/releases/tag/v2.5.2)以降、デフォルトでテンプレートの自動ダウンロード/更新をサポートしています。[**Nuclei-Templates**](https://github.com/projectdiscovery/nuclei-templates)プロジェクトは、常に更新されるコミュニティ提供の即時使用可能なテンプレートのリストを提供します。
|
||||
|
||||
`update-templates`フラグを使用して、いつでもNucleiテンプレートを更新することができます。Nucleiの[テンプレートガイド](https://docs.projectdiscovery.io/templates/)に従って、個々のワークフローとニーズに合わせた独自のチェックを作成することができます。
|
||||
|
||||
YAML DSLの構文リファレンスは[こちら](SYNTAX-REFERENCE.md)で確認できます。
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
### 使用方法
|
||||
|
||||
```sh
|
||||
nuclei -h
|
||||
```
|
||||
|
||||
これにより、ツールのヘルプが表示されます。ここには、サポートされているすべてのスイッチがあります。
|
||||
|
||||
```console
|
||||
Nucleiは、広範な設定可能性、大規模な拡張性、および使いやすさに焦点を当てた、
|
||||
高速でテンプレートベースの脆弱性スキャナーです。
|
||||
|
||||
使用法:
|
||||
./nuclei [flags]
|
||||
|
||||
フラグ:
|
||||
ターゲット:
|
||||
-u, -target string[] スキャンする対象のURL/ホスト
|
||||
-l, -list string スキャンする対象のURL/ホストのリストが含まれているファイルへのパス（1行に1つ）
|
||||
-resume string resume.cfgを使用してスキャンを再開（クラスタリングは無効になります）
|
||||
-sa, -scan-all-ips DNSレコードに関連付けられているすべてのIPをスキャン
|
||||
-iv, -ip-version string[] ホスト名のスキャンするIPバージョン（4,6）-（デフォルトは4）
|
||||
|
||||
テンプレート:
|
||||
-nt, -new-templates 最新のnuclei-templatesリリースに追加された新しいテンプレートのみを実行
|
||||
-ntv, -new-templates-version string[] 特定のバージョンに追加された新しいテンプレートを実行
|
||||
-as, -automatic-scan wappalyzer技術検出をタグマッピングに使用した自動Webスキャン
|
||||
-t, -templates string[] 実行するテンプレートまたはテンプレートディレクトリのリスト（カンマ区切り、ファイル）
|
||||
-turl, -template-url string[] 実行するテンプレートのURLまたはテンプレートURLのリスト（カンマ区切り、ファイル）
|
||||
-w, -workflows string[] 実行するワークフローまたはワークフローディレクトリのリスト（カンマ区切り、ファイル）
|
||||
-wurl, -workflow-url string[] 実行するワークフローのURLまたはワークフローURLのリスト（カンマ区切り、ファイル）
|
||||
-validate Nucleiに渡されたテンプレートを検証
|
||||
-nss, -no-strict-syntax テンプレートで厳密な構文チェックを無効にする
|
||||
-td, -template-display テンプレートの内容を表示
|
||||
-tl 利用可能なすべてのテンプレートをリスト
|
||||
-sign NUCLEI_SIGNATURE_PRIVATE_KEY環境変数で定義された秘密鍵でテンプレートに署名
|
||||
-code コードプロトコルベースのテンプレートのロードを有効にする
|
||||
|
||||
フィルタリング:
|
||||
-a, -author string[] 作者に基づいて実行するテンプレート（カンマ区切り、ファイル）
|
||||
-tags string[] タグに基づいて実行するテンプレート（カンマ区切り、ファイル）
|
||||
-etags, -exclude-tags string[] タグに基づいて除外するテンプレート（カンマ区切り、ファイル）
|
||||
-itags, -include-tags string[] デフォルトまたは設定によって除外されている場合でも実行する必要があるタグ
|
||||
-id, -template-id string[] テンプレートIDに基づいて実行するテンプレート（カンマ区切り、ファイル）
|
||||
-eid, -exclude-id string[] テンプレートIDに基づいて除外するテンプレート（カンマ区切り、ファイル）
|
||||
-it, -include-templates string[] デフォルトまたは設定によって除外されている場合でも実行する必要があるテンプレート
|
||||
-et, -exclude-templates string[] 除外するテンプレートまたはテンプレートディレクトリへのパス（カンマ区切り、ファイル）
|
||||
-em, -exclude-matchers string[] 結果で除外するテンプレートマッチャー
|
||||
-s, -severity value[] 重大度に基づいて実行するテンプレート。可能な値：info, low, medium, high, critical, unknown
|
||||
-es, -exclude-severity value[] 重大度に基づいて除外するテンプレート。可能な値：info, low, medium, high, critical, unknown
|
||||
-pt, -type value[] プロトコルタイプに基づいて実行するテンプレート。可能な値：dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript
|
||||
-ept, -exclude-type value[] プロトコルタイプに基づいて除外するテンプレート。可能な値：dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript
|
||||
-tc, -template-condition string[] 式条件に基づいて実行するテンプレート
|
||||
|
||||
出力:
|
||||
-o, -output string 発見された問題/脆弱性を書き込む出力ファイル
|
||||
-sresp, -store-resp Nucleiを通じて渡されたすべてのリクエスト/レスポンスを出力ディレクトリに保存
|
||||
-srd, -store-resp-dir string Nucleiを通じて渡されたすべてのリクエスト/レスポンスをカスタムディレクトリに保存（デフォルトは「output」）
|
||||
-silent 結果のみを表示
|
||||
-nc, -no-color 出力内容の着色を無効にする（ANSIエスケープコード）
|
||||
-j, -jsonl JSONL(ines)形式で出力を書き込む
|
||||
-irr, -include-rr -omit-raw JSON、JSONL、Markdown出力にリクエスト/レスポンスペアを含める（発見のみ）[非推奨 -omit-raw使用]（デフォルトはtrue）
|
||||
-or, -omit-raw JSON、JSONL、Markdown出力でリクエスト/レスポンスペアを省略する（発見のみ）
|
||||
-ot, -omit-template JSON、JSONL出力でエンコードされたテンプレートを省略
|
||||
-nm, -no-meta CLI出力で結果のメタデータの印刷を無効にする
|
||||
-ts, -timestamp CLI出力にタイムスタンプを印刷することを有効にする
|
||||
-rdb, -report-db string Nucleiレポートデータベース（レポートデータを永続化するために常にこれを使用）
|
||||
-ms, -matcher-status マッチ失敗のステータスを表示
|
||||
-me, -markdown-export string Markdown形式で結果をエクスポートするディレクトリ
|
||||
-se, -sarif-export string SARIF形式で結果をエクスポートするファイル
|
||||
-je, -json-export string JSON形式で結果をエクスポートするファイル
|
||||
-jle, -jsonl-export string JSONL(ine)形式で結果をエクスポートするファイル
|
||||
|
||||
設定:
|
||||
-config string Nucleiの設定ファイルへのパス
|
||||
-fr, -follow-redirects HTTPテンプレートのリダイレクトをフォローすることを有効にする
|
||||
-fhr, -follow-host-redirects
|
||||
+1
-2
@@ -30,8 +30,7 @@
|
||||
<p align="center">
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README.md">English</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_CN.md">中文</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_KR.md">한국어</a> •
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_ES.md">스페인어</a>
|
||||
<a href="https://github.com/projectdiscovery/nuclei/blob/main/README_KR.md">한국어</a>
|
||||
</p>
|
||||
|
||||
---
|
||||
|
||||
+1
-38
@@ -1800,50 +1800,13 @@ Valid values:
|
||||
|
||||
Part is the part of request to fuzz.
|
||||
|
||||
|
||||
Valid values:
|
||||
|
||||
|
||||
- <code>query</code>
|
||||
|
||||
- <code>header</code>
|
||||
|
||||
- <code>path</code>
|
||||
|
||||
- <code>body</code>
|
||||
|
||||
- <code>cookie</code>
|
||||
|
||||
- <code>request</code>
|
||||
</div>
|
||||
|
||||
<hr />
|
||||
|
||||
<div class="dd">
|
||||
|
||||
<code>parts</code> <i>[]string</i>
|
||||
|
||||
</div>
|
||||
<div class="dt">
|
||||
|
||||
Parts is the list of parts to fuzz. If multiple parts need to be
|
||||
defined while excluding some, this should be used instead of singular part.
|
||||
query fuzzes the query part of url. More parts will be added later.
|
||||
|
||||
|
||||
Valid values:
|
||||
|
||||
|
||||
- <code>query</code>
|
||||
|
||||
- <code>header</code>
|
||||
|
||||
- <code>path</code>
|
||||
|
||||
- <code>body</code>
|
||||
|
||||
- <code>cookie</code>
|
||||
|
||||
- <code>request</code>
|
||||
</div>
|
||||
|
||||
<hr />
|
||||
|
||||
@@ -23,7 +23,6 @@ import (
|
||||
logutil "github.com/projectdiscovery/utils/log"
|
||||
sliceutil "github.com/projectdiscovery/utils/slice"
|
||||
stringsutil "github.com/projectdiscovery/utils/strings"
|
||||
unitutils "github.com/projectdiscovery/utils/unit"
|
||||
)
|
||||
|
||||
var httpTestcases = []TestCaseInfo{
|
||||
@@ -510,7 +509,7 @@ func (h *httpPostMultipartBody) Execute(filePath string) error {
|
||||
var routerErr error
|
||||
|
||||
router.POST("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
|
||||
if err := r.ParseMultipartForm(unitutils.Mega); err != nil {
|
||||
if err := r.ParseMultipartForm(1 * 1024); err != nil {
|
||||
routerErr = err
|
||||
return
|
||||
}
|
||||
|
||||
+1
-5
@@ -38,7 +38,6 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/utils/monitor"
|
||||
errorutil "github.com/projectdiscovery/utils/errors"
|
||||
fileutil "github.com/projectdiscovery/utils/file"
|
||||
unitutils "github.com/projectdiscovery/utils/unit"
|
||||
updateutils "github.com/projectdiscovery/utils/update"
|
||||
)
|
||||
|
||||
@@ -305,7 +304,7 @@ on extensive configurability, massive extensibility and ease of use.`)
|
||||
flagSet.StringVarP(&options.AttackType, "attack-type", "at", "", "type of payload combinations to perform (batteringram,pitchfork,clusterbomb)"),
|
||||
flagSet.StringVarP(&options.SourceIP, "source-ip", "sip", "", "source ip address to use for network scan"),
|
||||
flagSet.IntVarP(&options.ResponseReadSize, "response-size-read", "rsr", 0, "max response size to read in bytes"),
|
||||
flagSet.IntVarP(&options.ResponseSaveSize, "response-size-save", "rss", unitutils.Mega, "max response size to read in bytes"),
|
||||
flagSet.IntVarP(&options.ResponseSaveSize, "response-size-save", "rss", 1*1024*1024, "max response size to read in bytes"),
|
||||
flagSet.DurationVarP(&options.ResponseReadTimeout, "response-read-timeout", "rrt", time.Duration(5*time.Second), "response read timeout in seconds"),
|
||||
flagSet.CallbackVar(resetCallback, "reset", "reset removes all nuclei configuration and data files (including nuclei-templates)"),
|
||||
flagSet.BoolVarP(&options.TlsImpersonate, "tls-impersonate", "tlsi", false, "enable experimental client hello (ja3) tls randomization"),
|
||||
@@ -327,9 +326,6 @@ on extensive configurability, massive extensibility and ease of use.`)
|
||||
flagSet.StringVarP(&options.FuzzingMode, "fuzzing-mode", "fm", "", "overrides fuzzing mode set in template (multiple, single)"),
|
||||
flagSet.BoolVar(&fuzzFlag, "fuzz", false, "enable loading fuzzing templates (Deprecated: use -dast instead)"),
|
||||
flagSet.BoolVar(&options.DAST, "dast", false, "enable / run dast (fuzz) nuclei templates"),
|
||||
flagSet.BoolVarP(&options.DisplayFuzzPoints, "display-fuzz-points", "dfp", false, "display fuzz points in the output for debugging"),
|
||||
flagSet.IntVar(&options.FuzzParamFrequency, "fuzz-param-frequency", 10, "frequency of uninteresting parameters for fuzzing before skipping"),
|
||||
flagSet.StringVarP(&options.FuzzAggressionLevel, "fuzz-aggression", "fa", "low", "fuzzing aggression level controls payload count for fuzz (low, medium, high)"),
|
||||
)
|
||||
|
||||
flagSet.CreateGroup("uncover", "Uncover",
|
||||
|
||||
@@ -20,12 +20,12 @@ require (
|
||||
github.com/olekukonko/tablewriter v0.0.5
|
||||
github.com/pkg/errors v0.9.1
|
||||
github.com/projectdiscovery/clistats v0.0.20
|
||||
github.com/projectdiscovery/fastdialer v0.1.5
|
||||
github.com/projectdiscovery/hmap v0.0.47
|
||||
github.com/projectdiscovery/interactsh v1.2.0
|
||||
github.com/projectdiscovery/rawhttp v0.1.51
|
||||
github.com/projectdiscovery/retryabledns v1.0.65
|
||||
github.com/projectdiscovery/retryablehttp-go v1.0.66
|
||||
github.com/projectdiscovery/fastdialer v0.1.0
|
||||
github.com/projectdiscovery/hmap v0.0.43
|
||||
github.com/projectdiscovery/interactsh v1.1.9
|
||||
github.com/projectdiscovery/rawhttp v0.1.49
|
||||
github.com/projectdiscovery/retryabledns v1.0.60
|
||||
github.com/projectdiscovery/retryablehttp-go v1.0.62
|
||||
github.com/projectdiscovery/yamldoc-go v1.0.4
|
||||
github.com/remeh/sizedwaitgroup v1.0.0
|
||||
github.com/rs/xid v1.5.0
|
||||
@@ -38,15 +38,15 @@ require (
|
||||
github.com/weppos/publicsuffix-go v0.30.2
|
||||
github.com/xanzy/go-gitlab v0.84.0
|
||||
go.uber.org/multierr v1.11.0
|
||||
golang.org/x/net v0.26.0
|
||||
golang.org/x/net v0.25.0
|
||||
golang.org/x/oauth2 v0.18.0
|
||||
golang.org/x/text v0.16.0
|
||||
golang.org/x/text v0.15.0
|
||||
gopkg.in/yaml.v2 v2.4.0
|
||||
)
|
||||
|
||||
require (
|
||||
code.gitea.io/sdk/gitea v0.17.0
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0
|
||||
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.1.0
|
||||
github.com/DataDog/gostackparse v0.6.0
|
||||
github.com/Masterminds/semver/v3 v3.2.1
|
||||
@@ -78,30 +78,30 @@ require (
|
||||
github.com/mholt/archiver v3.1.1+incompatible
|
||||
github.com/ory/dockertest/v3 v3.10.0
|
||||
github.com/praetorian-inc/fingerprintx v1.1.9
|
||||
github.com/projectdiscovery/dsl v0.1.3
|
||||
github.com/projectdiscovery/dsl v0.0.57
|
||||
github.com/projectdiscovery/fasttemplate v0.0.2
|
||||
github.com/projectdiscovery/go-smb2 v0.0.0-20240129202741-052cc450c6cb
|
||||
github.com/projectdiscovery/goflags v0.1.56
|
||||
github.com/projectdiscovery/goflags v0.1.53
|
||||
github.com/projectdiscovery/gologger v1.1.12
|
||||
github.com/projectdiscovery/gostruct v0.0.2
|
||||
github.com/projectdiscovery/gozero v0.0.2
|
||||
github.com/projectdiscovery/httpx v1.6.3
|
||||
github.com/projectdiscovery/httpx v1.6.1
|
||||
github.com/projectdiscovery/mapcidr v1.1.34
|
||||
github.com/projectdiscovery/n3iwf v0.0.0-20230523120440-b8cd232ff1f5
|
||||
github.com/projectdiscovery/ratelimit v0.0.45
|
||||
github.com/projectdiscovery/ratelimit v0.0.42
|
||||
github.com/projectdiscovery/rdap v0.9.1-0.20221108103045-9865884d1917
|
||||
github.com/projectdiscovery/sarif v0.0.1
|
||||
github.com/projectdiscovery/tlsx v1.1.6
|
||||
github.com/projectdiscovery/uncover v1.0.8
|
||||
github.com/projectdiscovery/useragent v0.0.56
|
||||
github.com/projectdiscovery/utils v0.1.4
|
||||
github.com/projectdiscovery/wappalyzergo v0.1.6
|
||||
github.com/projectdiscovery/useragent v0.0.52
|
||||
github.com/projectdiscovery/utils v0.1.0
|
||||
github.com/projectdiscovery/wappalyzergo v0.1.0
|
||||
github.com/redis/go-redis/v9 v9.1.0
|
||||
github.com/seh-msft/burpxml v1.0.1
|
||||
github.com/stretchr/testify v1.9.0
|
||||
github.com/tarunKoyalwar/goleak v0.0.0-20240429141123-0efa90dbdcf9
|
||||
github.com/zmap/zgrab2 v0.1.8-0.20230806160807-97ba87c0e706
|
||||
golang.org/x/term v0.21.0
|
||||
golang.org/x/term v0.20.0
|
||||
gopkg.in/yaml.v3 v3.0.1
|
||||
moul.io/http2curl v1.0.0
|
||||
)
|
||||
@@ -109,11 +109,11 @@ require (
|
||||
require (
|
||||
aead.dev/minisign v0.2.0 // indirect
|
||||
dario.cat/mergo v1.0.0 // indirect
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1 // indirect
|
||||
github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0 // indirect
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.0 // indirect
|
||||
github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
|
||||
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
|
||||
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
|
||||
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
|
||||
github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 // indirect
|
||||
github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
|
||||
github.com/VividCortex/ewma v1.2.0 // indirect
|
||||
github.com/andybalholm/brotli v1.1.0 // indirect
|
||||
@@ -124,7 +124,7 @@ require (
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.4 // indirect
|
||||
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
||||
github.com/bahlo/generic-list-go v0.2.0 // indirect
|
||||
github.com/bits-and-blooms/bitset v1.13.0 // indirect
|
||||
github.com/bits-and-blooms/bitset v1.8.0 // indirect
|
||||
github.com/bits-and-blooms/bloom/v3 v3.5.0 // indirect
|
||||
github.com/buger/jsonparser v1.1.1 // indirect
|
||||
github.com/bytedance/sonic v1.9.1 // indirect
|
||||
@@ -143,10 +143,9 @@ require (
|
||||
github.com/docker/cli v24.0.5+incompatible // indirect
|
||||
github.com/docker/docker v24.0.9+incompatible // indirect
|
||||
github.com/docker/go-connections v0.4.0 // indirect
|
||||
github.com/fatih/color v1.16.0 // indirect
|
||||
github.com/fatih/color v1.15.0 // indirect
|
||||
github.com/free5gc/util v1.0.5-0.20230511064842-2e120956883b // indirect
|
||||
github.com/gabriel-vasile/mimetype v1.4.2 // indirect
|
||||
github.com/gaissmai/bart v0.9.5 // indirect
|
||||
github.com/geoffgarside/ber v1.1.0 // indirect
|
||||
github.com/gin-contrib/sse v0.1.0 // indirect
|
||||
github.com/gin-gonic/gin v1.9.1 // indirect
|
||||
@@ -157,7 +156,6 @@ require (
|
||||
github.com/go-sourcemap/sourcemap v2.1.4+incompatible // indirect
|
||||
github.com/goccy/go-json v0.10.2 // indirect
|
||||
github.com/gogo/protobuf v1.3.2 // indirect
|
||||
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
|
||||
github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe // indirect
|
||||
github.com/golang-sql/sqlexp v0.1.0 // indirect
|
||||
github.com/google/certificate-transparency-go v1.1.4 // indirect
|
||||
@@ -199,7 +197,7 @@ require (
|
||||
github.com/perimeterx/marshmallow v1.1.5 // indirect
|
||||
github.com/pierrec/lz4/v4 v4.1.21 // indirect
|
||||
github.com/pjbgf/sha1cd v0.3.0 // indirect
|
||||
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
|
||||
github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
|
||||
github.com/projectdiscovery/asnmap v1.1.0 // indirect
|
||||
github.com/projectdiscovery/cdncheck v1.0.9 // indirect
|
||||
github.com/projectdiscovery/freeport v0.0.5 // indirect
|
||||
@@ -265,10 +263,10 @@ require (
|
||||
github.com/golang/protobuf v1.5.4 // indirect
|
||||
github.com/golang/snappy v0.0.4 // indirect
|
||||
github.com/google/go-querystring v1.1.0 // indirect
|
||||
github.com/google/uuid v1.6.0 // indirect
|
||||
github.com/google/uuid v1.3.1 // indirect
|
||||
github.com/gorilla/css v1.0.1 // indirect
|
||||
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
||||
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
|
||||
github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
|
||||
github.com/hdm/jarm-go v0.0.7 // indirect
|
||||
github.com/itchyny/timefmt-go v0.1.5 // indirect
|
||||
github.com/klauspost/cpuid/v2 v2.2.5 // indirect
|
||||
@@ -285,7 +283,7 @@ require (
|
||||
github.com/pmezard/go-difflib v1.0.0 // indirect
|
||||
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
|
||||
github.com/projectdiscovery/blackrock v0.0.1 // indirect
|
||||
github.com/projectdiscovery/networkpolicy v0.0.9
|
||||
github.com/projectdiscovery/networkpolicy v0.0.8
|
||||
github.com/rivo/uniseg v0.4.6 // indirect
|
||||
github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d // indirect
|
||||
github.com/tklauser/go-sysconf v0.3.12 // indirect
|
||||
@@ -303,12 +301,12 @@ require (
|
||||
go.etcd.io/bbolt v1.3.10 // indirect
|
||||
go.uber.org/zap v1.25.0 // indirect
|
||||
goftp.io/server/v2 v2.0.1 // indirect
|
||||
golang.org/x/crypto v0.24.0 // indirect
|
||||
golang.org/x/crypto v0.23.0 // indirect
|
||||
golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
|
||||
golang.org/x/mod v0.17.0 // indirect
|
||||
golang.org/x/sys v0.21.0 // indirect
|
||||
golang.org/x/sys v0.20.0 // indirect
|
||||
golang.org/x/time v0.5.0 // indirect
|
||||
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d
|
||||
golang.org/x/tools v0.21.0
|
||||
google.golang.org/appengine v1.6.8 // indirect
|
||||
google.golang.org/protobuf v1.33.0 // indirect
|
||||
gopkg.in/alecthomas/kingpin.v2 v2.2.6 // indirect
|
||||
|
||||
@@ -41,14 +41,14 @@ dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7
|
||||
git.mills.io/prologic/smtpd v0.0.0-20210710122116-a525b76c287a h1:3i+FJ7IpSZHL+VAjtpQeZCRhrpP0odl5XfoLBY4fxJ8=
|
||||
git.mills.io/prologic/smtpd v0.0.0-20210710122116-a525b76c287a/go.mod h1:C7hXLmFmPYPjIDGfQl1clsmQ5TMEQfmzWTrJk475bUs=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azcore v0.19.0/go.mod h1:h6H6c8enJmmocHUbLiiGY6sx7f9i+X3m1CHdd5c6Rdw=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1 h1:E+OJmp2tPvt1W+amx48v1eqbjDYsgN+RzP4q16yV5eM=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1/go.mod h1:a6xsAQUZg+VsS3TJ05SRp524Hs4pZ/AeFSr5ENf0Yjo=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.0 h1:8q4SaHjFsClSvuVne0ID/5Ka8u3fcIHyqkLjcFpNRHQ=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.7.0/go.mod h1:bjGvMhVMb+EEm3VRNQawDMUyMMjo+S5ewNjflkep/0Q=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.11.0/go.mod h1:HcM1YX14R7CJcghJGOYCgdezslRSVzqwLf/q+4Y2r/0=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0 h1:U2rTu3Ef+7w9FHKIAXM6ZyqF3UOWJZ12zIm8zECAFfg=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0/go.mod h1:9kIvujWAA58nmPmWB1m23fyWic1kYZMxD9CxaWn4Qpg=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0 h1:vcYCAze6p19qBW7MhZybIsqD8sMV8js0NyQM8JDnVtg=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0/go.mod h1:OQeznEEkTZ9OrhHJoDD8ZDq51FHgXjqtP9z6bEwBq9U=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/internal v0.7.0/go.mod h1:yqy467j36fJxcRV2TzfVZ1pCb5vxm4BtZPUdYWe/Xo8=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0 h1:jBQA3cKT4L2rWMpgE7Yt3Hwh2aUj8KXjIGLxjHeYNNo=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0/go.mod h1:4OG6tQ9EOP/MT0NMjDlRzWoVFxfu9rN9B2X+tlSVktg=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 h1:sXr+ck84g/ZlZUOZiNELInmMgOsuGwdjjVkEIde0OtY=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0/go.mod h1:okt5dMMTOFjX/aovMlrjvvXoPMBVSPzk9185BT0+eZM=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.2.0 h1:Ma67P/GGprNwsslzEH6+Kb8nybI8jpDTm4Wmzu2ReK8=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.2.0/go.mod h1:c+Lifp3EDEamAkPVzMooRNOK6CZjNSdEnf1A7jsI9u4=
|
||||
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.1.0 h1:nVocQV40OQne5613EeLayJiRAJuKlBGy+m22qWG+WRg=
|
||||
@@ -57,8 +57,8 @@ github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25
|
||||
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
|
||||
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
|
||||
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
|
||||
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 h1:XHOnouVk1mxXfQidrMEnLlPk9UMeRtyBTnEFtxkV0kU=
|
||||
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
|
||||
github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 h1:OBhqkivkhkMqLPymWEppkm7vgPQY2XsHoEkaMQ0AdZY=
|
||||
github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0/go.mod h1:kgDmCTgBzIEPFElEF+FK0SdjAor06dRq2Go927dnQ6o=
|
||||
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
|
||||
github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
|
||||
github.com/DataDog/gostackparse v0.6.0 h1:egCGQviIabPwsyoWpGvIBGrEnNWez35aEO7OJ1vBI4o=
|
||||
@@ -186,9 +186,8 @@ github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24
|
||||
github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
|
||||
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
|
||||
github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
|
||||
github.com/bits-and-blooms/bitset v1.8.0 h1:FD+XqgOZDUxxZ8hzoBFuV9+cGWY9CslN6d5MS5JVb4c=
|
||||
github.com/bits-and-blooms/bitset v1.8.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
|
||||
github.com/bits-and-blooms/bitset v1.13.0 h1:bAQ9OPNFYbGHV6Nez0tmNI0RiEu7/hxlYJRUA0wFAVE=
|
||||
github.com/bits-and-blooms/bitset v1.13.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
|
||||
github.com/bits-and-blooms/bloom/v3 v3.5.0 h1:AKDvi1V3xJCmSR6QhcBfHbCN4Vf8FfxeWkMNQfmAGhY=
|
||||
github.com/bits-and-blooms/bloom/v3 v3.5.0/go.mod h1:Y8vrn7nk1tPIlmLtW2ZPV+W7StdVMor6bC1xgpjMZFs=
|
||||
github.com/bluele/gcache v0.0.2 h1:WcbfdXICg7G/DGBh1PFfcirkWOQV+v077yF1pSy3DGw=
|
||||
@@ -274,6 +273,7 @@ github.com/dlclark/regexp2 v1.4.1-0.20201116162257-a2a8dda75c91/go.mod h1:2pZnwu
|
||||
github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
|
||||
github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
|
||||
github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
|
||||
github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
|
||||
github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
|
||||
github.com/docker/cli v24.0.5+incompatible h1:WeBimjvS0eKdH4Ygx+ihVq1Q++xg36M/rMi4aXAvodc=
|
||||
github.com/docker/cli v24.0.5+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
|
||||
@@ -310,8 +310,8 @@ github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.m
|
||||
github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
|
||||
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
|
||||
github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
|
||||
github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
|
||||
github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
|
||||
github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
|
||||
github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
|
||||
github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
|
||||
github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
|
||||
github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
|
||||
@@ -327,8 +327,6 @@ github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4
|
||||
github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
|
||||
github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
|
||||
github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
|
||||
github.com/gaissmai/bart v0.9.5 h1:vy+r4Px6bjZ+v2QYXAsg63vpz9IfzdW146A8Cn4GPIo=
|
||||
github.com/gaissmai/bart v0.9.5/go.mod h1:KHeYECXQiBjTzQz/om2tqn3sZF1J7hw9m6z41ftj3fg=
|
||||
github.com/geoffgarside/ber v1.1.0 h1:qTmFG4jJbwiSzSXoNJeHcOprVzZ8Ulde2Rrrifu5U9w=
|
||||
github.com/geoffgarside/ber v1.1.0/go.mod h1:jVPKeCbj6MvQZhwLYsGwaGI52oUorHoHKNecGT85ZCc=
|
||||
github.com/getkin/kin-openapi v0.123.0 h1:zIik0mRwFNLyvtXK274Q6ut+dPh6nlxBp0x7mNrPhs8=
|
||||
@@ -418,8 +416,6 @@ github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzq
|
||||
github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
|
||||
github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
|
||||
github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
|
||||
github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
|
||||
github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
|
||||
github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
|
||||
github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
|
||||
github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
|
||||
@@ -505,8 +501,8 @@ github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm4
|
||||
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
|
||||
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
|
||||
github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
|
||||
github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
|
||||
github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
|
||||
github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
|
||||
@@ -531,13 +527,13 @@ github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brv
|
||||
github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
|
||||
github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
|
||||
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
|
||||
github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
|
||||
github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
|
||||
github.com/hashicorp/go-hclog v0.9.2 h1:CG6TE5H9/JXsFWJCfoIVpKFIkFe6ysEuHirp4DxCsHI=
|
||||
github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
|
||||
github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
|
||||
github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
|
||||
github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
|
||||
github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
|
||||
github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
|
||||
github.com/hashicorp/go-retryablehttp v0.7.2 h1:AcYqCvkpalPnPF2pn0KamgwamS42TqUDDYFRKq/RAd0=
|
||||
github.com/hashicorp/go-retryablehttp v0.7.2/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
|
||||
github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
|
||||
github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
|
||||
github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
|
||||
@@ -812,8 +808,8 @@ github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFu
|
||||
github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
|
||||
github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
|
||||
github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=
|
||||
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
|
||||
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
|
||||
github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
|
||||
github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
|
||||
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
||||
@@ -834,30 +830,30 @@ github.com/projectdiscovery/cdncheck v1.0.9 h1:BS15gzj9gb5AVSKqTDzPamfSgStu7nJQO
|
||||
github.com/projectdiscovery/cdncheck v1.0.9/go.mod h1:18SSl1w7rMj53CGeRIZTbDoa286a6xZIxGbaiEo4Fxs=
|
||||
github.com/projectdiscovery/clistats v0.0.20 h1:5jO5SLiRJ7f0nDV0ndBNmBeesbROouPooH+DGMgoWq4=
|
||||
github.com/projectdiscovery/clistats v0.0.20/go.mod h1:GJ2av0KnOvK0AISQnP8hyDclYIji1LVkx2l0pwnzAu4=
|
||||
github.com/projectdiscovery/dsl v0.1.3 h1:Lxlgpx8lwq/CaBjVUmwF6KmkMDnYf9IVKlMsWCF72OE=
|
||||
github.com/projectdiscovery/dsl v0.1.3/go.mod h1:WAuQLD4KQ/94RASotE7cvk7X6kY7JQG9Fcqc3lRQfpI=
|
||||
github.com/projectdiscovery/fastdialer v0.1.5 h1:5rNJ8I+GVzDsUqRSVLUqGTm7LsshfNYmCh20lLn1aaI=
|
||||
github.com/projectdiscovery/fastdialer v0.1.5/go.mod h1:oVoMl9Y6da2timhszy0okyBvhbKDSk+zqFazGV4y6pU=
|
||||
github.com/projectdiscovery/dsl v0.0.57 h1:BFjkhtJHzvxSNO6bJJ0UkA7tIwysgsyqWbuhn3FVQfI=
|
||||
github.com/projectdiscovery/dsl v0.0.57/go.mod h1:w9XL7AT/RDyg7yiFQN8eWWefXiYQt3mojPDdjyTdQ0k=
|
||||
github.com/projectdiscovery/fastdialer v0.1.0 h1:NiId7eXvYZjiBo83AnIZ6K8ZjzLJU8wGXdRLzuKcRrg=
|
||||
github.com/projectdiscovery/fastdialer v0.1.0/go.mod h1:jKOWzyHx+Q2sMiYst5HP6tWLQLDFPVgWBR72szn2h8w=
|
||||
github.com/projectdiscovery/fasttemplate v0.0.2 h1:h2cISk5xDhlJEinlBQS6RRx0vOlOirB2y3Yu4PJzpiA=
|
||||
github.com/projectdiscovery/fasttemplate v0.0.2/go.mod h1:XYWWVMxnItd+r0GbjA1GCsUopMw1/XusuQxdyAIHMCw=
|
||||
github.com/projectdiscovery/freeport v0.0.5 h1:jnd3Oqsl4S8n0KuFkE5Hm8WGDP24ITBvmyw5pFTHS8Q=
|
||||
github.com/projectdiscovery/freeport v0.0.5/go.mod h1:PY0bxSJ34HVy67LHIeF3uIutiCSDwOqKD8ruBkdiCwE=
|
||||
github.com/projectdiscovery/go-smb2 v0.0.0-20240129202741-052cc450c6cb h1:rutG906Drtbpz4DwU5mhGIeOhRcktDH4cGQitGUMAsg=
|
||||
github.com/projectdiscovery/go-smb2 v0.0.0-20240129202741-052cc450c6cb/go.mod h1:FLjF1DmZ+POoGEiIQdWuYVwS++C/GwpX8YaCsTSm1RY=
|
||||
github.com/projectdiscovery/goflags v0.1.56 h1:tJYiZN7s9Jk9DxfYOUiqOoybaIDlXyX4ZgT4B/06SyU=
|
||||
github.com/projectdiscovery/goflags v0.1.56/go.mod h1:DsGF0NPpM5hGg75N3MTSvWJ4MIT7HFEAOEeWZ074+Fg=
|
||||
github.com/projectdiscovery/goflags v0.1.53 h1:wXNIMjvjBo0Hvo1183DQE2RyqlEbrhink/jYrFwRMwE=
|
||||
github.com/projectdiscovery/goflags v0.1.53/go.mod h1:yw4HnwPGKeCHx48tcl9ZqLrKeSArtUv2LK1dJP1i380=
|
||||
github.com/projectdiscovery/gologger v1.1.12 h1:uX/QkQdip4PubJjjG0+uk5DtyAi1ANPJUvpmimXqv4A=
|
||||
github.com/projectdiscovery/gologger v1.1.12/go.mod h1:DI8nywPLERS5mo8QEA9E7gd5HZ3Je14SjJBH3F5/kLw=
|
||||
github.com/projectdiscovery/gostruct v0.0.2 h1:s8gP8ApugGM4go1pA+sVlPDXaWqNP5BBDDSv7VEdG1M=
|
||||
github.com/projectdiscovery/gostruct v0.0.2/go.mod h1:H86peL4HKwMXcQQtEa6lmC8FuD9XFt6gkNR0B/Mu5PE=
|
||||
github.com/projectdiscovery/gozero v0.0.2 h1:8fJeaCjxL9tpm33uG/RsCQs6HGM/NE6eA3cjkilRQ+E=
|
||||
github.com/projectdiscovery/gozero v0.0.2/go.mod h1:d8bZvDWW07LWNYWrwjZ4OO1I0cpkfqaysyDfSs9ibK8=
|
||||
github.com/projectdiscovery/hmap v0.0.47 h1:NdakfvlFruevnOvehdllofg/hc0CQn2WQaLHaRcsGAk=
|
||||
github.com/projectdiscovery/hmap v0.0.47/go.mod h1:/9V6EnyTY33hAy71Quox6Ggu9ZkKp36tgepBh/NzNSg=
|
||||
github.com/projectdiscovery/httpx v1.6.3 h1:TSu3zEKOHGFfMsGeB0lZEFRl6Tq4nPuIgKDXi9NnYpg=
|
||||
github.com/projectdiscovery/httpx v1.6.3/go.mod h1:9FmsmkT71aTa4WnOyBIPzB8I9c0QAJ9PSVUqs2NkHRQ=
|
||||
github.com/projectdiscovery/interactsh v1.2.0 h1:Al6jHiR+Usl9egYJDLJaWNHOcH8Rugk8gWMasc8Cmw8=
|
||||
github.com/projectdiscovery/interactsh v1.2.0/go.mod h1:Wxt0fnzxsfrAZQQlpVrf3xMatP4OXZaZbjuDkIQKdYY=
|
||||
github.com/projectdiscovery/hmap v0.0.43 h1:9A/lGm/0uP9x2hP90dmK5vkc6KfGD0XYxDBAQ7lx/zg=
|
||||
github.com/projectdiscovery/hmap v0.0.43/go.mod h1:cMLXGlkLcPK0Y/aJVa+IZM9wdtkQ6HX4mHTXVC05Jbc=
|
||||
github.com/projectdiscovery/httpx v1.6.1 h1:aqKzoSydzKAJBV3Sxbqt44nTah4fNS9GkSD4Dy6Fzlc=
|
||||
github.com/projectdiscovery/httpx v1.6.1/go.mod h1:RvibGQbm2Bh2DtuBDVXHLfauFDLtp7opKHyk65sz0ss=
|
||||
github.com/projectdiscovery/interactsh v1.1.9 h1:b77SaSGrO+DtivmWwqGGY2dmNlQC3Zgmwlaj9L4Oqvc=
|
||||
github.com/projectdiscovery/interactsh v1.1.9/go.mod h1:0FRQXCildcTLq7Tsa4BVZAsFCXhpWs4C4quKWigXb5I=
|
||||
github.com/projectdiscovery/ldapserver v1.0.2-0.20240219154113-dcc758ebc0cb h1:MGtI4oE12ruWv11ZlPXXd7hl/uAaQZrFvrIDYDeVMd8=
|
||||
github.com/projectdiscovery/ldapserver v1.0.2-0.20240219154113-dcc758ebc0cb/go.mod h1:vmgC0DTFCfoCLp0RAfsfYTZZan0QMVs+cmTbH6blfjk=
|
||||
github.com/projectdiscovery/machineid v0.0.0-20240226150047-2e2c51e35983 h1:ZScLodGSezQVwsQDtBSMFp72WDq0nNN+KE/5DHKY5QE=
|
||||
@@ -866,18 +862,18 @@ github.com/projectdiscovery/mapcidr v1.1.34 h1:udr83vQ7oz3kEOwlsU6NC6o08leJzSDQt
|
||||
github.com/projectdiscovery/mapcidr v1.1.34/go.mod h1:1+1R6OkKSAKtWDXE9RvxXtXPoajXTYX0eiEdkqlhQqQ=
|
||||
github.com/projectdiscovery/n3iwf v0.0.0-20230523120440-b8cd232ff1f5 h1:L/e8z8yw1pfT6bg35NiN7yd1XKtJap5Nk6lMwQ0RNi8=
|
||||
github.com/projectdiscovery/n3iwf v0.0.0-20230523120440-b8cd232ff1f5/go.mod h1:pGW2ncnTxTxHtP9wzcIJAB+3/NMp6IiuQWd2NK7K+oc=
|
||||
github.com/projectdiscovery/networkpolicy v0.0.9 h1:IrlDoYZagNNO8y+7iZeHT8k5izE+nek7TdtvEBwCxqk=
|
||||
github.com/projectdiscovery/networkpolicy v0.0.9/go.mod h1:XFJ2Lnv8BE/ziQCFjBHMsH1w6VmkPiQtk+NlBpdMU7M=
|
||||
github.com/projectdiscovery/ratelimit v0.0.45 h1:h28oF+hJ0CHcdBZozT1Go7ppWmzTxSXDKNNh2G1Ot9Q=
|
||||
github.com/projectdiscovery/ratelimit v0.0.45/go.mod h1:1vSJUseDS7SjNwIBi9wNRcgsMKNTLxy/GfdlLFVbgI4=
|
||||
github.com/projectdiscovery/rawhttp v0.1.51 h1:T4sskU2fsX9zNR7nyae0tD/0fliIs73KwBzyoJwBs10=
|
||||
github.com/projectdiscovery/rawhttp v0.1.51/go.mod h1:ejBaw3dCfJSfbtFv0ib6YfFSjQzt7ZdRVpQWJASxIUs=
|
||||
github.com/projectdiscovery/networkpolicy v0.0.8 h1:XvfBaBwSDNTesSfNQP9VLk3HX9I7x7gHm028TJ5XwI8=
|
||||
github.com/projectdiscovery/networkpolicy v0.0.8/go.mod h1:xnjNqhemxUPxU+UD5Jgsc3+K8IVmcqT1SJeo6UzMtkI=
|
||||
github.com/projectdiscovery/ratelimit v0.0.42 h1:110tBLaGUgyPK0DjLmMBQaaqW4tkmqsFidr/t6tyOy4=
|
||||
github.com/projectdiscovery/ratelimit v0.0.42/go.mod h1:ruhLiZ5liukSpG07p6eHTCPJUmTwOhxDSxQPulvC3/Y=
|
||||
github.com/projectdiscovery/rawhttp v0.1.49 h1:OPP9R/UZx/GFrcPRUs9fOS1dLwhg+2o7p3dByzkIhWM=
|
||||
github.com/projectdiscovery/rawhttp v0.1.49/go.mod h1:aaAaMsdzHPfw4yU3nbeP7NI3vy1ZjgoXw7l+m4Tnt94=
|
||||
github.com/projectdiscovery/rdap v0.9.1-0.20221108103045-9865884d1917 h1:m03X4gBVSorSzvmm0bFa7gDV4QNSOWPL/fgZ4kTXBxk=
|
||||
github.com/projectdiscovery/rdap v0.9.1-0.20221108103045-9865884d1917/go.mod h1:JxXtZC9e195awe7EynrcnBJmFoad/BNDzW9mzFkK8Sg=
|
||||
github.com/projectdiscovery/retryabledns v1.0.65 h1:wOtMuVkrcrGkzaT8Jixb3BtUcJODXLRz+z9EjftmFsQ=
|
||||
github.com/projectdiscovery/retryabledns v1.0.65/go.mod h1:lf3xRdFhGh55fWVlzK1oAaDPrsKliqH3gGvsFNAOkCk=
|
||||
github.com/projectdiscovery/retryablehttp-go v1.0.66 h1:dY+sGVf/O8CvKcSdTx0rxJoKG+HyOScz5T89TijZohU=
|
||||
github.com/projectdiscovery/retryablehttp-go v1.0.66/go.mod h1:3QJt06j4hEZVpJOr31u49I3mDnqbAzhcjJX8Yvn/xnY=
|
||||
github.com/projectdiscovery/retryabledns v1.0.60 h1:f3TPeLnaJKrl9CbfsTfFTFnJY+UnyArH3mxxUUyR5ZQ=
|
||||
github.com/projectdiscovery/retryabledns v1.0.60/go.mod h1:T4Su40Wa9lVtRNMfMDFJi00g2T3FbTfwnKKkYON0WgU=
|
||||
github.com/projectdiscovery/retryablehttp-go v1.0.62 h1:ZY09NYRatoELHaPUcdRdWzHIJExjEqceHAfe7u/e9ZY=
|
||||
github.com/projectdiscovery/retryablehttp-go v1.0.62/go.mod h1:yhRy9Q3z0CuNUHIIPrveaubjVEwF4arKWT/5SQurQEE=
|
||||
github.com/projectdiscovery/sarif v0.0.1 h1:C2Tyj0SGOKbCLgHrx83vaE6YkzXEVrMXYRGLkKCr/us=
|
||||
github.com/projectdiscovery/sarif v0.0.1/go.mod h1:cEYlDu8amcPf6b9dSakcz2nNnJsoz4aR6peERwV+wuQ=
|
||||
github.com/projectdiscovery/stringsutil v0.0.2 h1:uzmw3IVLJSMW1kEg8eCStG/cGbYYZAja8BH3LqqJXMA=
|
||||
@@ -886,12 +882,12 @@ github.com/projectdiscovery/tlsx v1.1.6 h1:iw2zwKbd2+kRQ8J1G4dLmS0CLyemd/tKz1Uzc
|
||||
github.com/projectdiscovery/tlsx v1.1.6/go.mod h1:s7SRRFdrwIZBK/RXXZi4CR/CubqFSvp8h5Bk1srEZIo=
|
||||
github.com/projectdiscovery/uncover v1.0.8 h1:nE8bYJuwhqk0BEMRQRhNbjPGMy40A9gkiMk5xq6U4u0=
|
||||
github.com/projectdiscovery/uncover v1.0.8/go.mod h1:1SwsNqjwMkJEzJQ7lQr5AHIdYd+BQlyqhO5IwIYmIAM=
|
||||
github.com/projectdiscovery/useragent v0.0.56 h1:KpUtOgq1vUerPrgRFZAIr1hF0lDxA2RF6YkT2PLwSoQ=
|
||||
github.com/projectdiscovery/useragent v0.0.56/go.mod h1:LAh9vudxXPA5JfNN3+1g/Unqvulq0BDkjxK7IrE+e/s=
|
||||
github.com/projectdiscovery/utils v0.1.4 h1:VSULN/RBEXbkgWuhrDey84ZDnSXtYMSev9p+QHXXDeI=
|
||||
github.com/projectdiscovery/utils v0.1.4/go.mod h1:mXs6OOeG9l/dVchjB2PGvQO3+wuMiE14Y/kmHeKogoM=
|
||||
github.com/projectdiscovery/wappalyzergo v0.1.6 h1:4iZDEnytsnAqjQgD5K6lmAzVx++KSQeMCDfomDtQM1M=
|
||||
github.com/projectdiscovery/wappalyzergo v0.1.6/go.mod h1:wBYGKmA5BQp/NWsAy1q/jSH8N1LHWQ/LV26DuR+KzPM=
|
||||
github.com/projectdiscovery/useragent v0.0.52 h1:9SUPH0Epo3DJfB6PCDgETfMaD6nZ08sFvfgXTmPUAsU=
|
||||
github.com/projectdiscovery/useragent v0.0.52/go.mod h1:PUXHgShvaD8p3bihy1mY8tuBDhdk3M0yy4Z10Ajg2yQ=
|
||||
github.com/projectdiscovery/utils v0.1.0 h1:r7Z/s2CBktJ0bnSN410lzOhD8S/0IxmzmFxkQudYKps=
|
||||
github.com/projectdiscovery/utils v0.1.0/go.mod h1:RaBdJLTKF5FKZ/RtMeccqFBtpsSjaggVw6/oPTpDD40=
|
||||
github.com/projectdiscovery/wappalyzergo v0.1.0 h1:ZagOIKemBsNfCDRQeWavWEXtEjP8UiziuoRoPTwDAJ0=
|
||||
github.com/projectdiscovery/wappalyzergo v0.1.0/go.mod h1:wBYGKmA5BQp/NWsAy1q/jSH8N1LHWQ/LV26DuR+KzPM=
|
||||
github.com/projectdiscovery/yamldoc-go v1.0.4 h1:eZoESapnMw6WAHiVgRwNqvbJEfNHEH148uthhFbG5jE=
|
||||
github.com/projectdiscovery/yamldoc-go v1.0.4/go.mod h1:8PIPRcUD55UbtQdcfFR1hpIGRWG0P7alClXNGt1TBik=
|
||||
github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
|
||||
@@ -1187,9 +1183,8 @@ golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58
|
||||
golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
|
||||
golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
|
||||
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
|
||||
golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
|
||||
golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
|
||||
golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
|
||||
golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
|
||||
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
|
||||
@@ -1283,9 +1278,8 @@ golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
|
||||
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
|
||||
golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
|
||||
golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
|
||||
golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
|
||||
golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
|
||||
golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
|
||||
golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
|
||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||
@@ -1362,6 +1356,7 @@ golang.org/x/sys v0.0.0-20210228012217-479acdf4ea46/go.mod h1:h1NjWce9XRLGQEsW7w
|
||||
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
@@ -1376,7 +1371,6 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
|
||||
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
@@ -1386,9 +1380,8 @@ golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
|
||||
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
|
||||
golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
@@ -1400,9 +1393,8 @@ golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
|
||||
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
|
||||
golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
|
||||
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
|
||||
golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw=
|
||||
golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
|
||||
golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
|
||||
golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
|
||||
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
@@ -1418,9 +1410,8 @@ golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
|
||||
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
|
||||
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
|
||||
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
|
||||
golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
|
||||
golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
|
||||
golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
|
||||
golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
|
||||
golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
@@ -1478,8 +1469,8 @@ golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc
|
||||
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
|
||||
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
|
||||
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
|
||||
golang.org/x/tools v0.21.0 h1:qc0xYgIbsSDt9EyWz05J5wfa7LOVW0YTLOXrqdLAWIw=
|
||||
golang.org/x/tools v0.21.0/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
|
||||
@@ -15,18 +15,21 @@ http:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'method == "GET"'
|
||||
- regex("/(.*?/)([0-9]+)(/.*)?",path)
|
||||
condition: and
|
||||
|
||||
payloads:
|
||||
pathsqli:
|
||||
- "'OR1=1"
|
||||
- '%20OR%20True'
|
||||
|
||||
fuzzing:
|
||||
- part: path
|
||||
type: postfix
|
||||
type: replace-regex
|
||||
mode: single
|
||||
replace-regex: '/(.*?/)([0-9]+)(/.*)?'
|
||||
fuzz:
|
||||
- '{{pathsqli}}'
|
||||
- '/${1}${2}{{pathsqli}}${3}'
|
||||
|
||||
matchers:
|
||||
- type: status
|
||||
|
||||
+2
-10
@@ -18,9 +18,7 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/output"
|
||||
"github.com/projectdiscovery/retryablehttp-go"
|
||||
pdcpauth "github.com/projectdiscovery/utils/auth/pdcp"
|
||||
"github.com/projectdiscovery/utils/env"
|
||||
errorutil "github.com/projectdiscovery/utils/errors"
|
||||
unitutils "github.com/projectdiscovery/utils/unit"
|
||||
updateutils "github.com/projectdiscovery/utils/update"
|
||||
urlutil "github.com/projectdiscovery/utils/url"
|
||||
)
|
||||
@@ -28,17 +26,14 @@ import (
|
||||
const (
|
||||
uploadEndpoint = "/v1/scans/import"
|
||||
appendEndpoint = "/v1/scans/%s/import"
|
||||
flushTimer = time.Minute
|
||||
MaxChunkSize = 4 * unitutils.Mega // 4 MB
|
||||
flushTimer = time.Duration(1) * time.Minute
|
||||
MaxChunkSize = 1024 * 1024 * 4 // 4 MB
|
||||
xidRe = `^[a-z0-9]{20}$`
|
||||
teamIDHeader = "X-Team-Id"
|
||||
)
|
||||
|
||||
var (
|
||||
xidRegex = regexp.MustCompile(xidRe)
|
||||
_ output.Writer = &UploadWriter{}
|
||||
// teamID if given
|
||||
teamID = env.GetEnvOrDefault("PDCP_TEAM_ID", "")
|
||||
)
|
||||
|
||||
// UploadWriter is a writer that uploads its output to pdcp
|
||||
@@ -248,9 +243,6 @@ func (u *UploadWriter) getRequest(bin []byte) (*retryablehttp.Request, error) {
|
||||
req.URL.Update()
|
||||
|
||||
req.Header.Set(pdcpauth.ApiKeyHeaderName, u.creds.APIKey)
|
||||
if teamID != "" {
|
||||
req.Header.Set(teamIDHeader, teamID)
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/octet-stream")
|
||||
req.Header.Set("Accept", "application/json")
|
||||
return req, nil
|
||||
|
||||
@@ -322,6 +322,9 @@ func createReportingOptions(options *types.Options) (*reporting.Options, error)
|
||||
|
||||
// configureOutput configures the output logging levels to be displayed on the screen
|
||||
func configureOutput(options *types.Options) {
|
||||
// disable standard logger (ref: https://github.com/golang/go/issues/19895)
|
||||
defer logutil.DisableDefaultLogger()
|
||||
|
||||
if options.NoColor {
|
||||
gologger.DefaultLogger.SetFormatter(formatter.NewCLI(true))
|
||||
}
|
||||
@@ -340,9 +343,6 @@ func configureOutput(options *types.Options) {
|
||||
if options.Silent {
|
||||
gologger.DefaultLogger.SetMaxLevel(levels.LevelSilent)
|
||||
}
|
||||
|
||||
// disable standard logger (ref: https://github.com/golang/go/issues/19895)
|
||||
logutil.DisableDefaultLogger()
|
||||
}
|
||||
|
||||
// loadResolvers loads resolvers from both user-provided flags and file
|
||||
|
||||
+30
-37
@@ -15,7 +15,6 @@ import (
|
||||
|
||||
"github.com/projectdiscovery/nuclei/v3/internal/pdcp"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/authprovider"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/fuzz/frequency"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/input/provider"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/installer"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/loader/parser"
|
||||
@@ -75,22 +74,21 @@ var (
|
||||
|
||||
// Runner is a client for running the enumeration process.
|
||||
type Runner struct {
|
||||
output output.Writer
|
||||
interactsh *interactsh.Client
|
||||
options *types.Options
|
||||
projectFile *projectfile.ProjectFile
|
||||
catalog catalog.Catalog
|
||||
progress progress.Progress
|
||||
colorizer aurora.Aurora
|
||||
issuesClient reporting.Client
|
||||
browser *engine.Browser
|
||||
rateLimiter *ratelimit.Limiter
|
||||
hostErrors hosterrorscache.CacheInterface
|
||||
resumeCfg *types.ResumeCfg
|
||||
pprofServer *http.Server
|
||||
pdcpUploadErrMsg string
|
||||
inputProvider provider.InputProvider
|
||||
fuzzFrequencyCache *frequency.Tracker
|
||||
output output.Writer
|
||||
interactsh *interactsh.Client
|
||||
options *types.Options
|
||||
projectFile *projectfile.ProjectFile
|
||||
catalog catalog.Catalog
|
||||
progress progress.Progress
|
||||
colorizer aurora.Aurora
|
||||
issuesClient reporting.Client
|
||||
browser *engine.Browser
|
||||
rateLimiter *ratelimit.Limiter
|
||||
hostErrors hosterrorscache.CacheInterface
|
||||
resumeCfg *types.ResumeCfg
|
||||
pprofServer *http.Server
|
||||
pdcpUploadErrMsg string
|
||||
inputProvider provider.InputProvider
|
||||
//general purpose temporary directory
|
||||
tmpDir string
|
||||
parser parser.Parser
|
||||
@@ -450,28 +448,24 @@ func (r *Runner) RunEnumeration() error {
|
||||
r.options.ExcludedTemplates = append(r.options.ExcludedTemplates, ignoreFile.Files...)
|
||||
}
|
||||
|
||||
fuzzFreqCache := frequency.New(frequency.DefaultMaxTrackCount, r.options.FuzzParamFrequency)
|
||||
r.fuzzFrequencyCache = fuzzFreqCache
|
||||
|
||||
// Create the executor options which will be used throughout the execution
|
||||
// stage by the nuclei engine modules.
|
||||
executorOpts := protocols.ExecutorOptions{
|
||||
Output: r.output,
|
||||
Options: r.options,
|
||||
Progress: r.progress,
|
||||
Catalog: r.catalog,
|
||||
IssuesClient: r.issuesClient,
|
||||
RateLimiter: r.rateLimiter,
|
||||
Interactsh: r.interactsh,
|
||||
ProjectFile: r.projectFile,
|
||||
Browser: r.browser,
|
||||
Colorizer: r.colorizer,
|
||||
ResumeCfg: r.resumeCfg,
|
||||
ExcludeMatchers: excludematchers.New(r.options.ExcludeMatchers),
|
||||
InputHelper: input.NewHelper(),
|
||||
TemporaryDirectory: r.tmpDir,
|
||||
Parser: r.parser,
|
||||
FuzzParamsFrequency: fuzzFreqCache,
|
||||
Output: r.output,
|
||||
Options: r.options,
|
||||
Progress: r.progress,
|
||||
Catalog: r.catalog,
|
||||
IssuesClient: r.issuesClient,
|
||||
RateLimiter: r.rateLimiter,
|
||||
Interactsh: r.interactsh,
|
||||
ProjectFile: r.projectFile,
|
||||
Browser: r.browser,
|
||||
Colorizer: r.colorizer,
|
||||
ResumeCfg: r.resumeCfg,
|
||||
ExcludeMatchers: excludematchers.New(r.options.ExcludeMatchers),
|
||||
InputHelper: input.NewHelper(),
|
||||
TemporaryDirectory: r.tmpDir,
|
||||
Parser: r.parser,
|
||||
}
|
||||
|
||||
if config.DefaultConfig.IsDebugArgEnabled(config.DebugExportURLPattern) {
|
||||
@@ -625,7 +619,6 @@ func (r *Runner) RunEnumeration() error {
|
||||
if executorOpts.InputHelper != nil {
|
||||
_ = executorOpts.InputHelper.Close()
|
||||
}
|
||||
r.fuzzFrequencyCache.Close()
|
||||
|
||||
// todo: error propagation without canonical straight error check is required by cloud?
|
||||
// use safe dereferencing to avoid potential panics in case of previous unchecked errors
|
||||
|
||||
+1
-7
@@ -164,17 +164,11 @@ func WithConcurrency(opts Concurrency) NucleiSDKOptions {
|
||||
}
|
||||
|
||||
// WithGlobalRateLimit sets global rate (i.e all hosts combined) limit options
|
||||
// Deprecated: will be removed in favour of WithGlobalRateLimitCtx in next release
|
||||
func WithGlobalRateLimit(maxTokens int, duration time.Duration) NucleiSDKOptions {
|
||||
return WithGlobalRateLimitCtx(context.Background(), maxTokens, duration)
|
||||
}
|
||||
|
||||
// WithGlobalRateLimitCtx allows setting a global rate limit for the entire engine
|
||||
func WithGlobalRateLimitCtx(ctx context.Context, maxTokens int, duration time.Duration) NucleiSDKOptions {
|
||||
return func(e *NucleiEngine) error {
|
||||
e.opts.RateLimit = maxTokens
|
||||
e.opts.RateLimitDuration = duration
|
||||
e.rateLimiter = ratelimit.New(ctx, uint(e.opts.RateLimit), e.opts.RateLimitDuration)
|
||||
e.rateLimiter = ratelimit.New(context.Background(), uint(e.opts.RateLimit), e.opts.RateLimitDuration)
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
+7
-13
@@ -26,7 +26,7 @@ type unsafeOptions struct {
|
||||
}
|
||||
|
||||
// createEphemeralObjects creates ephemeral nuclei objects/instances/types
|
||||
func createEphemeralObjects(ctx context.Context, base *NucleiEngine, opts *types.Options) (*unsafeOptions, error) {
|
||||
func createEphemeralObjects(base *NucleiEngine, opts *types.Options) (*unsafeOptions, error) {
|
||||
u := &unsafeOptions{}
|
||||
u.executerOpts = protocols.ExecutorOptions{
|
||||
Output: base.customWriter,
|
||||
@@ -49,9 +49,9 @@ func createEphemeralObjects(ctx context.Context, base *NucleiEngine, opts *types
|
||||
opts.RateLimitDuration = time.Second
|
||||
}
|
||||
if opts.RateLimit == 0 && opts.RateLimitDuration == 0 {
|
||||
u.executerOpts.RateLimiter = ratelimit.NewUnlimited(ctx)
|
||||
u.executerOpts.RateLimiter = ratelimit.NewUnlimited(context.Background())
|
||||
} else {
|
||||
u.executerOpts.RateLimiter = ratelimit.New(ctx, uint(opts.RateLimit), opts.RateLimitDuration)
|
||||
u.executerOpts.RateLimiter = ratelimit.New(context.Background(), uint(opts.RateLimit), opts.RateLimitDuration)
|
||||
}
|
||||
u.engine = core.New(opts)
|
||||
u.engine.SetExecuterOptions(u.executerOpts)
|
||||
@@ -83,7 +83,7 @@ type ThreadSafeNucleiEngine struct {
|
||||
// NewThreadSafeNucleiEngine creates a new nuclei engine with given options
|
||||
// whose methods are thread-safe and can be used concurrently
|
||||
// Note: Non-thread-safe methods start with Global prefix
|
||||
func NewThreadSafeNucleiEngineCtx(ctx context.Context, opts ...NucleiSDKOptions) (*ThreadSafeNucleiEngine, error) {
|
||||
func NewThreadSafeNucleiEngine(opts ...NucleiSDKOptions) (*ThreadSafeNucleiEngine, error) {
|
||||
// default options
|
||||
e := &NucleiEngine{
|
||||
opts: types.DefaultOptions(),
|
||||
@@ -94,17 +94,12 @@ func NewThreadSafeNucleiEngineCtx(ctx context.Context, opts ...NucleiSDKOptions)
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
if err := e.init(ctx); err != nil {
|
||||
if err := e.init(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &ThreadSafeNucleiEngine{eng: e}, nil
|
||||
}
|
||||
|
||||
// Deprecated: use NewThreadSafeNucleiEngineCtx instead
|
||||
func NewThreadSafeNucleiEngine(opts ...NucleiSDKOptions) (*ThreadSafeNucleiEngine, error) {
|
||||
return NewThreadSafeNucleiEngineCtx(context.Background(), opts...)
|
||||
}
|
||||
|
||||
// GlobalLoadAllTemplates loads all templates from nuclei-templates repo
|
||||
// This method will load all templates based on filters given at the time of nuclei engine creation in opts
|
||||
func (e *ThreadSafeNucleiEngine) GlobalLoadAllTemplates() error {
|
||||
@@ -128,9 +123,8 @@ func (e *ThreadSafeNucleiEngine) ExecuteNucleiWithOptsCtx(ctx context.Context, t
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
// create ephemeral nuclei objects/instances/types using base nuclei engine
|
||||
unsafeOpts, err := createEphemeralObjects(ctx, e.eng, tmpEngine.opts)
|
||||
unsafeOpts, err := createEphemeralObjects(e.eng, tmpEngine.opts)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -162,7 +156,7 @@ func (e *ThreadSafeNucleiEngine) ExecuteNucleiWithOptsCtx(ctx context.Context, t
|
||||
engine := core.New(tmpEngine.opts)
|
||||
engine.SetExecuterOptions(unsafeOpts.executerOpts)
|
||||
|
||||
_ = engine.ExecuteScanWithOpts(ctx, store.Templates(), inputProvider, false)
|
||||
_ = engine.ExecuteScanWithOpts(context.Background(), store.Templates(), inputProvider, false)
|
||||
|
||||
engine.WorkPool().Wait()
|
||||
return nil
|
||||
|
||||
+9
-17
@@ -18,7 +18,7 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/hosterrorscache"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/interactsh"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/protocolinit"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/protocolstate"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/headless/engine"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/reporting"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/templates"
|
||||
@@ -183,7 +183,8 @@ func (e *NucleiEngine) SignTemplate(tmplSigner *signer.TemplateSigner, data []by
|
||||
return buff.Bytes(), err
|
||||
}
|
||||
|
||||
func (e *NucleiEngine) closeInternal() {
|
||||
// Close all resources used by nuclei engine
|
||||
func (e *NucleiEngine) Close() {
|
||||
if e.interactshClient != nil {
|
||||
e.interactshClient.Close()
|
||||
}
|
||||
@@ -205,6 +206,8 @@ func (e *NucleiEngine) closeInternal() {
|
||||
if e.rateLimiter != nil {
|
||||
e.rateLimiter.Stop()
|
||||
}
|
||||
// close global shared resources
|
||||
protocolstate.Close()
|
||||
if e.inputProvider != nil {
|
||||
e.inputProvider.Close()
|
||||
}
|
||||
@@ -216,12 +219,6 @@ func (e *NucleiEngine) closeInternal() {
|
||||
}
|
||||
}
|
||||
|
||||
// Close all resources used by nuclei engine
|
||||
func (e *NucleiEngine) Close() {
|
||||
e.closeInternal()
|
||||
protocolinit.Close()
|
||||
}
|
||||
|
||||
// ExecuteCallbackWithCtx executes templates on targets and calls callback on each result(only if results are found)
|
||||
// enable matcher-status option if you expect this callback to be called for all results regardless if it matched or not
|
||||
func (e *NucleiEngine) ExecuteCallbackWithCtx(ctx context.Context, callback ...func(event *output.ResultEvent)) error {
|
||||
@@ -243,7 +240,7 @@ func (e *NucleiEngine) ExecuteCallbackWithCtx(ctx context.Context, callback ...f
|
||||
}
|
||||
e.resultCallbacks = append(e.resultCallbacks, filtered...)
|
||||
|
||||
_ = e.engine.ExecuteScanWithOpts(ctx, e.store.Templates(), e.inputProvider, false)
|
||||
_ = e.engine.ExecuteScanWithOpts(context.Background(), e.store.Templates(), e.inputProvider, false)
|
||||
defer e.engine.WorkPool().Wait()
|
||||
return nil
|
||||
}
|
||||
@@ -264,8 +261,8 @@ func (e *NucleiEngine) Engine() *core.Engine {
|
||||
return e.engine
|
||||
}
|
||||
|
||||
// NewNucleiEngineCtx creates a new nuclei engine instance with given context
|
||||
func NewNucleiEngineCtx(ctx context.Context, options ...NucleiSDKOptions) (*NucleiEngine, error) {
|
||||
// NewNucleiEngine creates a new nuclei engine instance
|
||||
func NewNucleiEngine(options ...NucleiSDKOptions) (*NucleiEngine, error) {
|
||||
// default options
|
||||
e := &NucleiEngine{
|
||||
opts: types.DefaultOptions(),
|
||||
@@ -276,13 +273,8 @@ func NewNucleiEngineCtx(ctx context.Context, options ...NucleiSDKOptions) (*Nucl
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
if err := e.init(ctx); err != nil {
|
||||
if err := e.init(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return e, nil
|
||||
}
|
||||
|
||||
// Deprecated: use NewNucleiEngineCtx instead
|
||||
func NewNucleiEngine(options ...NucleiSDKOptions) (*NucleiEngine, error) {
|
||||
return NewNucleiEngineCtx(context.Background(), options...)
|
||||
}
|
||||
+16
-24
@@ -25,7 +25,6 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/hosterrorscache"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/interactsh"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/protocolinit"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/protocolstate"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/http/httpclientpool"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/reporting"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/templates"
|
||||
@@ -35,10 +34,10 @@ import (
|
||||
"github.com/projectdiscovery/ratelimit"
|
||||
)
|
||||
|
||||
var sharedInit *sync.Once
|
||||
var sharedInit sync.Once = sync.Once{}
|
||||
|
||||
// applyRequiredDefaults to options
|
||||
func (e *NucleiEngine) applyRequiredDefaults(ctx context.Context) {
|
||||
func (e *NucleiEngine) applyRequiredDefaults() {
|
||||
mockoutput := testutils.NewMockOutputWriter(e.opts.OmitTemplate)
|
||||
mockoutput.WriteCallback = func(event *output.ResultEvent) {
|
||||
if len(e.resultCallbacks) > 0 {
|
||||
@@ -82,7 +81,7 @@ func (e *NucleiEngine) applyRequiredDefaults(ctx context.Context) {
|
||||
e.interactshOpts = interactsh.DefaultOptions(e.customWriter, e.rc, e.customProgress)
|
||||
}
|
||||
if e.rateLimiter == nil {
|
||||
e.rateLimiter = ratelimit.New(ctx, 150, time.Second)
|
||||
e.rateLimiter = ratelimit.New(context.Background(), 150, time.Second)
|
||||
}
|
||||
if e.opts.ExcludeTags == nil {
|
||||
e.opts.ExcludeTags = []string{}
|
||||
@@ -95,7 +94,7 @@ func (e *NucleiEngine) applyRequiredDefaults(ctx context.Context) {
|
||||
}
|
||||
|
||||
// init
|
||||
func (e *NucleiEngine) init(ctx context.Context) error {
|
||||
func (e *NucleiEngine) init() error {
|
||||
if e.opts.Verbose {
|
||||
gologger.DefaultLogger.SetMaxLevel(levels.LevelVerbose)
|
||||
} else if e.opts.Debug {
|
||||
@@ -108,19 +107,6 @@ func (e *NucleiEngine) init(ctx context.Context) error {
|
||||
return err
|
||||
}
|
||||
|
||||
e.parser = templates.NewParser()
|
||||
|
||||
if sharedInit == nil || protocolstate.ShouldInit() {
|
||||
sharedInit = &sync.Once{}
|
||||
}
|
||||
|
||||
sharedInit.Do(func() {
|
||||
_ = protocolinit.Init(e.opts)
|
||||
})
|
||||
|
||||
e.applyRequiredDefaults(ctx)
|
||||
var err error
|
||||
|
||||
if e.opts.ProxyInternal && types.ProxyURL != "" || types.ProxySocksURL != "" {
|
||||
httpclient, err := httpclientpool.Get(e.opts, &httpclientpool.Configuration{})
|
||||
if err != nil {
|
||||
@@ -129,6 +115,15 @@ func (e *NucleiEngine) init(ctx context.Context) error {
|
||||
e.httpClient = httpclient
|
||||
}
|
||||
|
||||
e.parser = templates.NewParser()
|
||||
|
||||
sharedInit.Do(func() {
|
||||
_ = protocolinit.Init(e.opts)
|
||||
})
|
||||
|
||||
e.applyRequiredDefaults()
|
||||
var err error
|
||||
|
||||
// setup progressbar
|
||||
if e.enableStats {
|
||||
progressInstance, progressErr := progress.NewStatsTicker(e.opts.StatsInterval, e.enableStats, e.opts.StatsJSON, false, e.opts.MetricsPort)
|
||||
@@ -209,9 +204,9 @@ func (e *NucleiEngine) init(ctx context.Context) error {
|
||||
e.opts.RateLimitDuration = time.Second
|
||||
}
|
||||
if e.opts.RateLimit == 0 && e.opts.RateLimitDuration == 0 {
|
||||
e.executerOpts.RateLimiter = ratelimit.NewUnlimited(ctx)
|
||||
e.executerOpts.RateLimiter = ratelimit.NewUnlimited(context.Background())
|
||||
} else {
|
||||
e.executerOpts.RateLimiter = ratelimit.New(ctx, uint(e.opts.RateLimit), e.opts.RateLimitDuration)
|
||||
e.executerOpts.RateLimiter = ratelimit.New(context.Background(), uint(e.opts.RateLimit), e.opts.RateLimitDuration)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -231,10 +226,7 @@ func (e *NucleiEngine) init(ctx context.Context) error {
|
||||
// and also upgrade templates to latest version if available
|
||||
installer.NucleiSDKVersionCheck()
|
||||
|
||||
if DefaultConfig.CanCheckForUpdates() {
|
||||
return e.processUpdateCheckResults()
|
||||
}
|
||||
return nil
|
||||
return e.processUpdateCheckResults()
|
||||
}
|
||||
|
||||
type syncOnce struct {
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
package sdk_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os"
|
||||
"os/exec"
|
||||
"testing"
|
||||
@@ -29,8 +28,7 @@ func TestSimpleNuclei(t *testing.T) {
|
||||
time.Sleep(2 * time.Second)
|
||||
goleak.VerifyNone(t, knownLeaks...)
|
||||
}()
|
||||
ne, err := nuclei.NewNucleiEngineCtx(
|
||||
context.TODO(),
|
||||
ne, err := nuclei.NewNucleiEngine(
|
||||
nuclei.WithTemplateFilters(nuclei.TemplateFilters{ProtocolTypes: "dns"}), // filter dns templates
|
||||
nuclei.EnableStatsWithOpts(nuclei.StatsOptions{JSON: true}),
|
||||
)
|
||||
@@ -64,8 +62,7 @@ func TestSimpleNucleiRemote(t *testing.T) {
|
||||
time.Sleep(2 * time.Second)
|
||||
goleak.VerifyNone(t, knownLeaks...)
|
||||
}()
|
||||
ne, err := nuclei.NewNucleiEngineCtx(
|
||||
context.TODO(),
|
||||
ne, err := nuclei.NewNucleiEngine(
|
||||
nuclei.WithTemplatesOrWorkflows(
|
||||
nuclei.TemplateSources{
|
||||
RemoteTemplates: []string{"https://cloud.projectdiscovery.io/public/nameserver-fingerprint.yaml"},
|
||||
@@ -103,7 +100,7 @@ func TestThreadSafeNuclei(t *testing.T) {
|
||||
goleak.VerifyNone(t, knownLeaks...)
|
||||
}()
|
||||
// create nuclei engine with options
|
||||
ne, err := nuclei.NewThreadSafeNucleiEngineCtx(context.TODO())
|
||||
ne, err := nuclei.NewThreadSafeNucleiEngine()
|
||||
require.Nil(t, err)
|
||||
|
||||
// scan 1 = run dns templates on scanme.sh
|
||||
|
||||
@@ -457,22 +457,6 @@
|
||||
"title": "part of rule",
|
||||
"description": "Part of request rule to fuzz"
|
||||
},
|
||||
"parts": {
|
||||
"items": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"query",
|
||||
"header",
|
||||
"path",
|
||||
"body",
|
||||
"cookie",
|
||||
"request"
|
||||
]
|
||||
},
|
||||
"type": "array",
|
||||
"title": "parts of rule",
|
||||
"description": "Part of request rule to fuzz"
|
||||
},
|
||||
"mode": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
|
||||
@@ -31,7 +31,7 @@ const (
|
||||
CLIConfigFileName = "config.yaml"
|
||||
ReportingConfigFilename = "reporting-config.yaml"
|
||||
// Version is the current version of nuclei
|
||||
Version = `v3.2.9`
|
||||
Version = `v3.2.8`
|
||||
// Directory Names of custom templates
|
||||
CustomS3TemplatesDirName = "s3"
|
||||
CustomGitHubTemplatesDirName = "github"
|
||||
|
||||
+10
-22
@@ -11,25 +11,17 @@ import (
|
||||
// DiskCatalog is a template catalog helper implementation based on disk
|
||||
type DiskCatalog struct {
|
||||
templatesDirectory string
|
||||
templatesFS fs.FS // Due to issues with how Go has implemented fs.FS, we'll have to also implement normal os operations, as well. See: https://github.com/golang/go/issues/44279
|
||||
templatesFS fs.FS // TODO: Refactor to use this
|
||||
}
|
||||
|
||||
// NewCatalog creates a new Catalog structure using provided input items
|
||||
// using disk based items
|
||||
func NewCatalog(directory string) *DiskCatalog {
|
||||
catalog := &DiskCatalog{templatesDirectory: directory}
|
||||
if directory == "" {
|
||||
catalog.templatesDirectory = config.DefaultConfig.GetTemplateDir()
|
||||
}
|
||||
return catalog
|
||||
}
|
||||
|
||||
// NewFSCatalog creates a new Catalog structure using provided input items
|
||||
// using the fs.FS as its filesystem.
|
||||
func NewFSCatalog(fs fs.FS, directory string) *DiskCatalog {
|
||||
catalog := &DiskCatalog{
|
||||
templatesDirectory: directory,
|
||||
templatesFS: fs,
|
||||
if directory != "" {
|
||||
catalog.templatesFS = os.DirFS(directory)
|
||||
} else {
|
||||
catalog.templatesFS = os.DirFS(config.DefaultConfig.GetTemplateDir())
|
||||
}
|
||||
return catalog
|
||||
}
|
||||
@@ -37,15 +29,11 @@ func NewFSCatalog(fs fs.FS, directory string) *DiskCatalog {
|
||||
// OpenFile opens a file and returns an io.ReadCloser to the file.
|
||||
// It is used to read template and payload files based on catalog responses.
|
||||
func (d *DiskCatalog) OpenFile(filename string) (io.ReadCloser, error) {
|
||||
if d.templatesFS == nil {
|
||||
file, err := os.Open(filename)
|
||||
if err != nil {
|
||||
if file, errx := os.Open(BackwardsCompatiblePaths(d.templatesDirectory, filename)); errx == nil {
|
||||
return file, nil
|
||||
}
|
||||
file, err := os.Open(filename)
|
||||
if err != nil {
|
||||
if file, errx := os.Open(BackwardsCompatiblePaths(d.templatesDirectory, filename)); errx == nil {
|
||||
return file, nil
|
||||
}
|
||||
return file, err
|
||||
}
|
||||
|
||||
return d.templatesFS.Open(filename)
|
||||
return file, err
|
||||
}
|
||||
+37
-110
@@ -79,21 +79,17 @@ func (c *DiskCatalog) GetTemplatePath(target string) ([]string, error) {
|
||||
}
|
||||
|
||||
// try to handle deprecated template paths
|
||||
absPath := target
|
||||
if c.templatesFS == nil {
|
||||
absPath = BackwardsCompatiblePaths(c.templatesDirectory, target)
|
||||
if absPath != target && strings.TrimPrefix(absPath, c.templatesDirectory+string(filepath.Separator)) != target {
|
||||
if config.DefaultConfig.LogAllEvents {
|
||||
gologger.DefaultLogger.Print().Msgf("[%v] requested Template path %s is deprecated, please update to %s\n", aurora.Yellow("WRN").String(), target, absPath)
|
||||
}
|
||||
deprecatedPathsCounter++
|
||||
absPath := BackwardsCompatiblePaths(c.templatesDirectory, target)
|
||||
if absPath != target && strings.TrimPrefix(absPath, c.templatesDirectory+string(filepath.Separator)) != target {
|
||||
if config.DefaultConfig.LogAllEvents {
|
||||
gologger.DefaultLogger.Print().Msgf("[%v] requested Template path %s is deprecated, please update to %s\n", aurora.Yellow("WRN").String(), target, absPath)
|
||||
}
|
||||
deprecatedPathsCounter++
|
||||
}
|
||||
|
||||
var err error
|
||||
absPath, err = c.convertPathToAbsolute(absPath)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "could not find template file")
|
||||
}
|
||||
absPath, err := c.convertPathToAbsolute(absPath)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "could not find template file")
|
||||
}
|
||||
|
||||
// Template input is either a file or a directory
|
||||
@@ -147,60 +143,24 @@ func (c *DiskCatalog) findGlobPathMatches(absPath string, processed map[string]s
|
||||
if c.templatesDirectory == "" {
|
||||
templateDir = "./"
|
||||
}
|
||||
|
||||
if c.templatesFS == nil {
|
||||
matches, _ := fs.Glob(os.DirFS(filepath.Join(templateDir, "http")), inputGlob)
|
||||
if len(matches) != 0 {
|
||||
return matches
|
||||
}
|
||||
|
||||
// condition to support network cve related globs
|
||||
matches, _ = fs.Glob(os.DirFS(filepath.Join(templateDir, "network")), inputGlob)
|
||||
return matches
|
||||
} else {
|
||||
sub, err := fs.Sub(c.templatesFS, filepath.Join(templateDir, "http"))
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
matches, _ := fs.Glob(sub, inputGlob)
|
||||
if len(matches) != 0 {
|
||||
return matches
|
||||
}
|
||||
|
||||
// condition to support network cve related globs
|
||||
sub, err = fs.Sub(c.templatesFS, filepath.Join(templateDir, "network"))
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
matches, _ = fs.Glob(sub, inputGlob)
|
||||
matches, _ := fs.Glob(os.DirFS(filepath.Join(templateDir, "http")), inputGlob)
|
||||
if len(matches) != 0 {
|
||||
return matches
|
||||
}
|
||||
// condition to support network cve related globs
|
||||
matches, _ = fs.Glob(os.DirFS(filepath.Join(templateDir, "network")), inputGlob)
|
||||
return matches
|
||||
}
|
||||
|
||||
var matched []string
|
||||
var matches []string
|
||||
if c.templatesFS == nil {
|
||||
var err error
|
||||
matches, err = filepath.Glob(relPath)
|
||||
if len(matches) != 0 {
|
||||
matched = append(matched, matches...)
|
||||
} else {
|
||||
matched = append(matched, OldPathsResolver(relPath)...)
|
||||
}
|
||||
if err != nil && len(matched) == 0 {
|
||||
return nil, errors.Errorf("wildcard found, but unable to glob: %s\n", err)
|
||||
}
|
||||
matches, err := fs.Glob(c.templatesFS, relPath)
|
||||
if len(matches) != 0 {
|
||||
matched = append(matched, matches...)
|
||||
} else {
|
||||
var err error
|
||||
matches, err = fs.Glob(c.templatesFS, relPath)
|
||||
if len(matches) != 0 {
|
||||
matched = append(matched, matches...)
|
||||
} else {
|
||||
matched = append(matched, OldPathsResolver(relPath)...)
|
||||
}
|
||||
if err != nil && len(matched) == 0 {
|
||||
return nil, errors.Errorf("wildcard found, but unable to glob: %s\n", err)
|
||||
}
|
||||
matched = append(matched, OldPathsResolver(relPath)...)
|
||||
}
|
||||
if err != nil && len(matched) == 0 {
|
||||
return nil, errors.Errorf("wildcard found, but unable to glob: %s\n", err)
|
||||
}
|
||||
results := make([]string, 0, len(matches))
|
||||
for _, match := range matches {
|
||||
@@ -215,23 +175,11 @@ func (c *DiskCatalog) findGlobPathMatches(absPath string, processed map[string]s
|
||||
// findFileMatches finds if a path is an absolute file. If the path
|
||||
// is a file, it returns true otherwise false with no errors.
|
||||
func (c *DiskCatalog) findFileMatches(absPath string, processed map[string]struct{}) (match string, matched bool, err error) {
|
||||
if c.templatesFS != nil {
|
||||
absPath = strings.TrimPrefix(absPath, "/")
|
||||
}
|
||||
var info fs.File
|
||||
if c.templatesFS == nil {
|
||||
info, err = os.Open(absPath)
|
||||
} else {
|
||||
info, err = c.templatesFS.Open(absPath)
|
||||
}
|
||||
info, err := os.Stat(absPath)
|
||||
if err != nil {
|
||||
return "", false, err
|
||||
}
|
||||
stat, err := info.Stat()
|
||||
if err != nil {
|
||||
return "", false, err
|
||||
}
|
||||
if !stat.Mode().IsRegular() {
|
||||
if !info.Mode().IsRegular() {
|
||||
return "", false, nil
|
||||
}
|
||||
if _, ok := processed[absPath]; !ok {
|
||||
@@ -244,43 +192,22 @@ func (c *DiskCatalog) findFileMatches(absPath string, processed map[string]struc
|
||||
// findDirectoryMatches finds matches for templates from a directory
|
||||
func (c *DiskCatalog) findDirectoryMatches(absPath string, processed map[string]struct{}) ([]string, error) {
|
||||
var results []string
|
||||
var err error
|
||||
if c.templatesFS == nil {
|
||||
err = filepath.WalkDir(
|
||||
absPath,
|
||||
func(path string, d fs.DirEntry, err error) error {
|
||||
// continue on errors
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
if !d.IsDir() && config.GetTemplateFormatFromExt(path) != config.Unknown {
|
||||
if _, ok := processed[path]; !ok {
|
||||
results = append(results, path)
|
||||
processed[path] = struct{}{}
|
||||
}
|
||||
}
|
||||
err := filepath.WalkDir(
|
||||
absPath,
|
||||
func(path string, d fs.DirEntry, err error) error {
|
||||
// continue on errors
|
||||
if err != nil {
|
||||
return nil
|
||||
},
|
||||
)
|
||||
} else {
|
||||
err = fs.WalkDir(
|
||||
c.templatesFS,
|
||||
absPath,
|
||||
func(path string, d fs.DirEntry, err error) error {
|
||||
// continue on errors
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
if !d.IsDir() && config.GetTemplateFormatFromExt(path) != config.Unknown {
|
||||
if _, ok := processed[path]; !ok {
|
||||
results = append(results, path)
|
||||
processed[path] = struct{}{}
|
||||
}
|
||||
if !d.IsDir() && config.GetTemplateFormatFromExt(path) != config.Unknown {
|
||||
if _, ok := processed[path]; !ok {
|
||||
results = append(results, path)
|
||||
processed[path] = struct{}{}
|
||||
}
|
||||
}
|
||||
return nil
|
||||
},
|
||||
)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
},
|
||||
)
|
||||
return results, err
|
||||
}
|
||||
|
||||
|
||||
@@ -7,7 +7,6 @@ import (
|
||||
"os"
|
||||
"sort"
|
||||
"strings"
|
||||
"sync"
|
||||
|
||||
"github.com/logrusorgru/aurora"
|
||||
"github.com/pkg/errors"
|
||||
@@ -24,7 +23,6 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/workflows"
|
||||
"github.com/projectdiscovery/retryablehttp-go"
|
||||
errorutil "github.com/projectdiscovery/utils/errors"
|
||||
sliceutil "github.com/projectdiscovery/utils/slice"
|
||||
stringsutil "github.com/projectdiscovery/utils/strings"
|
||||
urlutil "github.com/projectdiscovery/utils/url"
|
||||
)
|
||||
@@ -427,10 +425,10 @@ func (store *Store) LoadTemplatesWithTags(templatesList, tags []string) []*templ
|
||||
store.logErroredTemplates(errs)
|
||||
templatePathMap := store.pathFilter.Match(includedTemplates)
|
||||
|
||||
loadedTemplates := sliceutil.NewSyncSlice[*templates.Template]()
|
||||
loadedTemplates := make([]*templates.Template, 0, len(templatePathMap))
|
||||
|
||||
loadTemplate := func(tmpl *templates.Template) {
|
||||
loadedTemplates.Append(tmpl)
|
||||
loadedTemplates = append(loadedTemplates, tmpl)
|
||||
// increment signed/unsigned counters
|
||||
if tmpl.Verified {
|
||||
if tmpl.TemplateVerifier == "" {
|
||||
@@ -443,89 +441,80 @@ func (store *Store) LoadTemplatesWithTags(templatesList, tags []string) []*templ
|
||||
}
|
||||
}
|
||||
|
||||
var wgLoadTemplates sync.WaitGroup
|
||||
|
||||
for templatePath := range templatePathMap {
|
||||
wgLoadTemplates.Add(1)
|
||||
go func(templatePath string) {
|
||||
defer wgLoadTemplates.Done()
|
||||
|
||||
loaded, err := store.config.ExecutorOptions.Parser.LoadTemplate(templatePath, store.tagFilter, tags, store.config.Catalog)
|
||||
if loaded || store.pathFilter.MatchIncluded(templatePath) {
|
||||
parsed, err := templates.Parse(templatePath, store.preprocessor, store.config.ExecutorOptions)
|
||||
if err != nil {
|
||||
// exclude templates not compatible with offline matching from total runtime warning stats
|
||||
if !errors.Is(err, templates.ErrIncompatibleWithOfflineMatching) {
|
||||
stats.Increment(templates.RuntimeWarningsStats)
|
||||
}
|
||||
gologger.Warning().Msgf("Could not parse template %s: %s\n", templatePath, err)
|
||||
} else if parsed != nil {
|
||||
if !parsed.Verified && store.config.ExecutorOptions.Options.DisableUnsignedTemplates {
|
||||
// skip unverified templates when prompted to
|
||||
stats.Increment(templates.SkippedUnsignedStats)
|
||||
return
|
||||
}
|
||||
// if template has request signature like aws then only signed and verified templates are allowed
|
||||
if parsed.UsesRequestSignature() && !parsed.Verified {
|
||||
stats.Increment(templates.SkippedRequestSignatureStats)
|
||||
return
|
||||
}
|
||||
// DAST only templates
|
||||
if store.config.ExecutorOptions.Options.DAST {
|
||||
// check if the template is a DAST template
|
||||
if parsed.IsFuzzing() {
|
||||
loadTemplate(parsed)
|
||||
}
|
||||
} else if len(parsed.RequestsHeadless) > 0 && !store.config.ExecutorOptions.Options.Headless {
|
||||
// donot include headless template in final list if headless flag is not set
|
||||
stats.Increment(templates.ExcludedHeadlessTmplStats)
|
||||
if config.DefaultConfig.LogAllEvents {
|
||||
gologger.Print().Msgf("[%v] Headless flag is required for headless template '%s'.\n", aurora.Yellow("WRN").String(), templatePath)
|
||||
}
|
||||
} else if len(parsed.RequestsCode) > 0 && !store.config.ExecutorOptions.Options.EnableCodeTemplates {
|
||||
// donot include 'Code' protocol custom template in final list if code flag is not set
|
||||
stats.Increment(templates.ExcludedCodeTmplStats)
|
||||
if config.DefaultConfig.LogAllEvents {
|
||||
gologger.Print().Msgf("[%v] Code flag is required for code protocol template '%s'.\n", aurora.Yellow("WRN").String(), templatePath)
|
||||
}
|
||||
} else if len(parsed.RequestsCode) > 0 && !parsed.Verified && len(parsed.Workflows) == 0 {
|
||||
// donot include unverified 'Code' protocol custom template in final list
|
||||
stats.Increment(templates.SkippedCodeTmplTamperedStats)
|
||||
// these will be skipped so increment skip counter
|
||||
stats.Increment(templates.SkippedUnsignedStats)
|
||||
if config.DefaultConfig.LogAllEvents {
|
||||
gologger.Print().Msgf("[%v] Tampered/Unsigned template at %v.\n", aurora.Yellow("WRN").String(), templatePath)
|
||||
}
|
||||
} else if parsed.IsFuzzing() && !store.config.ExecutorOptions.Options.DAST {
|
||||
stats.Increment(templates.ExludedDastTmplStats)
|
||||
if config.DefaultConfig.LogAllEvents {
|
||||
gologger.Print().Msgf("[%v] -dast flag is required for DAST template '%s'.\n", aurora.Yellow("WRN").String(), templatePath)
|
||||
}
|
||||
} else {
|
||||
loaded, err := store.config.ExecutorOptions.Parser.LoadTemplate(templatePath, store.tagFilter, tags, store.config.Catalog)
|
||||
if loaded || store.pathFilter.MatchIncluded(templatePath) {
|
||||
parsed, err := templates.Parse(templatePath, store.preprocessor, store.config.ExecutorOptions)
|
||||
if err != nil {
|
||||
// exclude templates not compatible with offline matching from total runtime warning stats
|
||||
if !errors.Is(err, templates.ErrIncompatibleWithOfflineMatching) {
|
||||
stats.Increment(templates.RuntimeWarningsStats)
|
||||
}
|
||||
gologger.Warning().Msgf("Could not parse template %s: %s\n", templatePath, err)
|
||||
} else if parsed != nil {
|
||||
if !parsed.Verified && store.config.ExecutorOptions.Options.DisableUnsignedTemplates {
|
||||
// skip unverified templates when prompted to
|
||||
stats.Increment(templates.SkippedUnsignedStats)
|
||||
continue
|
||||
}
|
||||
// if template has request signature like aws then only signed and verified templates are allowed
|
||||
if parsed.UsesRequestSignature() && !parsed.Verified {
|
||||
stats.Increment(templates.SkippedRequestSignatureStats)
|
||||
continue
|
||||
}
|
||||
// DAST only templates
|
||||
if store.config.ExecutorOptions.Options.DAST {
|
||||
// check if the template is a DAST template
|
||||
if parsed.IsFuzzing() {
|
||||
loadTemplate(parsed)
|
||||
}
|
||||
}
|
||||
}
|
||||
if err != nil {
|
||||
if strings.Contains(err.Error(), templates.ErrExcluded.Error()) {
|
||||
stats.Increment(templates.TemplatesExcludedStats)
|
||||
} else if len(parsed.RequestsHeadless) > 0 && !store.config.ExecutorOptions.Options.Headless {
|
||||
// donot include headless template in final list if headless flag is not set
|
||||
stats.Increment(templates.ExcludedHeadlessTmplStats)
|
||||
if config.DefaultConfig.LogAllEvents {
|
||||
gologger.Print().Msgf("[%v] %v\n", aurora.Yellow("WRN").String(), err.Error())
|
||||
gologger.Print().Msgf("[%v] Headless flag is required for headless template '%s'.\n", aurora.Yellow("WRN").String(), templatePath)
|
||||
}
|
||||
return
|
||||
} else if len(parsed.RequestsCode) > 0 && !store.config.ExecutorOptions.Options.EnableCodeTemplates {
|
||||
// donot include 'Code' protocol custom template in final list if code flag is not set
|
||||
stats.Increment(templates.ExcludedCodeTmplStats)
|
||||
if config.DefaultConfig.LogAllEvents {
|
||||
gologger.Print().Msgf("[%v] Code flag is required for code protocol template '%s'.\n", aurora.Yellow("WRN").String(), templatePath)
|
||||
}
|
||||
} else if len(parsed.RequestsCode) > 0 && !parsed.Verified && len(parsed.Workflows) == 0 {
|
||||
// donot include unverified 'Code' protocol custom template in final list
|
||||
stats.Increment(templates.SkippedCodeTmplTamperedStats)
|
||||
// these will be skipped so increment skip counter
|
||||
stats.Increment(templates.SkippedUnsignedStats)
|
||||
if config.DefaultConfig.LogAllEvents {
|
||||
gologger.Print().Msgf("[%v] Tampered/Unsigned template at %v.\n", aurora.Yellow("WRN").String(), templatePath)
|
||||
}
|
||||
} else if parsed.IsFuzzing() && !store.config.ExecutorOptions.Options.DAST {
|
||||
stats.Increment(templates.ExludedDastTmplStats)
|
||||
if config.DefaultConfig.LogAllEvents {
|
||||
gologger.Print().Msgf("[%v] -dast flag is required for DAST template '%s'.\n", aurora.Yellow("WRN").String(), templatePath)
|
||||
}
|
||||
} else {
|
||||
loadTemplate(parsed)
|
||||
}
|
||||
gologger.Warning().Msg(err.Error())
|
||||
}
|
||||
}(templatePath)
|
||||
}
|
||||
if err != nil {
|
||||
if strings.Contains(err.Error(), templates.ErrExcluded.Error()) {
|
||||
stats.Increment(templates.TemplatesExcludedStats)
|
||||
if config.DefaultConfig.LogAllEvents {
|
||||
gologger.Print().Msgf("[%v] %v\n", aurora.Yellow("WRN").String(), err.Error())
|
||||
}
|
||||
continue
|
||||
}
|
||||
gologger.Warning().Msg(err.Error())
|
||||
}
|
||||
}
|
||||
|
||||
wgLoadTemplates.Wait()
|
||||
|
||||
sort.SliceStable(loadedTemplates.Slice, func(i, j int) bool {
|
||||
return loadedTemplates.Slice[i].Path < loadedTemplates.Slice[j].Path
|
||||
sort.SliceStable(loadedTemplates, func(i, j int) bool {
|
||||
return loadedTemplates[i].Path < loadedTemplates[j].Path
|
||||
})
|
||||
|
||||
return loadedTemplates.Slice
|
||||
return loadedTemplates
|
||||
}
|
||||
|
||||
// IsHTTPBasedProtocolUsed returns true if http/headless protocol is being used for
|
||||
|
||||
+12
-38
@@ -2,12 +2,10 @@ package component
|
||||
|
||||
import (
|
||||
"context"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/fuzz/dataformat"
|
||||
"github.com/projectdiscovery/retryablehttp-go"
|
||||
urlutil "github.com/projectdiscovery/utils/url"
|
||||
)
|
||||
|
||||
// Path is a component for a request Path
|
||||
@@ -33,18 +31,13 @@ func (q *Path) Name() string {
|
||||
// parsed component
|
||||
func (q *Path) Parse(req *retryablehttp.Request) (bool, error) {
|
||||
q.req = req
|
||||
q.value = NewValue("")
|
||||
q.value = NewValue(req.URL.Path)
|
||||
|
||||
splitted := strings.Split(req.URL.Path, "/")
|
||||
values := make(map[string]interface{})
|
||||
for i := range splitted {
|
||||
pathTillNow := strings.Join(splitted[:i+1], "/")
|
||||
if pathTillNow == "" {
|
||||
continue
|
||||
}
|
||||
values[strconv.Itoa(i)] = pathTillNow
|
||||
parsed, err := dataformat.Get(dataformat.RawDataFormat).Decode(q.value.String())
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
q.value.SetParsed(dataformat.KVMap(values), "")
|
||||
q.value.SetParsed(parsed, dataformat.RawDataFormat)
|
||||
return true, nil
|
||||
}
|
||||
|
||||
@@ -63,8 +56,7 @@ func (q *Path) Iterate(callback func(key string, value interface{}) error) (err
|
||||
// SetValue sets a value in the component
|
||||
// for a key
|
||||
func (q *Path) SetValue(key string, value string) error {
|
||||
escaped := urlutil.ParamEncode(value)
|
||||
if !q.value.SetParsedValue(key, escaped) {
|
||||
if !q.value.SetParsedValue(key, value) {
|
||||
return ErrSetValue
|
||||
}
|
||||
return nil
|
||||
@@ -81,31 +73,13 @@ func (q *Path) Delete(key string) error {
|
||||
// Rebuild returns a new request with the
|
||||
// component rebuilt
|
||||
func (q *Path) Rebuild() (*retryablehttp.Request, error) {
|
||||
originalValues := make(map[string]interface{})
|
||||
splitted := strings.Split(q.req.URL.Path, "/")
|
||||
for i := range splitted {
|
||||
pathTillNow := strings.Join(splitted[:i+1], "/")
|
||||
if pathTillNow == "" {
|
||||
continue
|
||||
}
|
||||
originalValues[strconv.Itoa(i)] = pathTillNow
|
||||
encoded, err := q.value.Encode()
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "could not encode query")
|
||||
}
|
||||
|
||||
originalPath := q.req.URL.Path
|
||||
lengthSplitted := len(q.value.parsed.Map)
|
||||
for i := lengthSplitted; i > 0; i-- {
|
||||
key := strconv.Itoa(i)
|
||||
original := originalValues[key].(string)
|
||||
new := q.value.parsed.Map[key].(string)
|
||||
originalPath = strings.Replace(originalPath, original, new, 1)
|
||||
}
|
||||
|
||||
rebuiltPath := originalPath
|
||||
|
||||
// Clone the request and update the path
|
||||
cloned := q.req.Clone(context.Background())
|
||||
if err := cloned.UpdateRelPath(rebuiltPath, true); err != nil {
|
||||
cloned.URL.RawPath = rebuiltPath
|
||||
if err := cloned.UpdateRelPath(encoded, true); err != nil {
|
||||
cloned.URL.RawPath = encoded
|
||||
}
|
||||
return cloned, nil
|
||||
}
|
||||
|
||||
@@ -28,10 +28,10 @@ func TestURLComponent(t *testing.T) {
|
||||
return nil
|
||||
})
|
||||
|
||||
require.Equal(t, []string{"1"}, keys, "unexpected keys")
|
||||
require.Equal(t, []string{"value"}, keys, "unexpected keys")
|
||||
require.Equal(t, []string{"/testpath"}, values, "unexpected values")
|
||||
|
||||
err = urlComponent.SetValue("1", "/newpath")
|
||||
err = urlComponent.SetValue("value", "/newpath")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
@@ -40,41 +40,7 @@ func TestURLComponent(t *testing.T) {
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
require.Equal(t, "/newpath", rebuilt.URL.Path, "unexpected URL path")
|
||||
require.Equal(t, "https://example.com/newpath", rebuilt.URL.String(), "unexpected full URL")
|
||||
}
|
||||
|
||||
func TestURLComponent_NestedPaths(t *testing.T) {
|
||||
path := NewPath()
|
||||
req, err := retryablehttp.NewRequest(http.MethodGet, "https://example.com/user/753/profile", nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
found, err := path.Parse(req)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !found {
|
||||
t.Fatal("expected path to be found")
|
||||
}
|
||||
|
||||
isSet := false
|
||||
|
||||
_ = path.Iterate(func(key string, value interface{}) error {
|
||||
if !isSet && value.(string) == "/user/753" {
|
||||
isSet = true
|
||||
if setErr := path.SetValue(key, "/user/753'"); setErr != nil {
|
||||
t.Fatal(setErr)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
})
|
||||
|
||||
newReq, err := path.Rebuild()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if newReq.URL.Path != "/user/753'/profile" {
|
||||
t.Fatal("expected path to be modified")
|
||||
}
|
||||
}
|
||||
@@ -61,7 +61,6 @@ func (q *Query) Iterate(callback func(key string, value interface{}) error) (err
|
||||
// SetValue sets a value in the component
|
||||
// for a key
|
||||
func (q *Query) SetValue(key string, value string) error {
|
||||
// Is this safe?
|
||||
if !q.value.SetParsedValue(key, value) {
|
||||
return ErrSetValue
|
||||
}
|
||||
|
||||
+4
-23
@@ -1,7 +1,6 @@
|
||||
package fuzz
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"regexp"
|
||||
@@ -16,7 +15,6 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/generators"
|
||||
"github.com/projectdiscovery/retryablehttp-go"
|
||||
errorutil "github.com/projectdiscovery/utils/errors"
|
||||
sliceutil "github.com/projectdiscovery/utils/slice"
|
||||
urlutil "github.com/projectdiscovery/utils/url"
|
||||
)
|
||||
|
||||
@@ -47,8 +45,6 @@ type ExecuteRuleInput struct {
|
||||
Values map[string]interface{}
|
||||
// BaseRequest is the base http request for fuzzing rule
|
||||
BaseRequest *retryablehttp.Request
|
||||
// DisplayFuzzPoints is a flag to display fuzz points
|
||||
DisplayFuzzPoints bool
|
||||
}
|
||||
|
||||
// GeneratedRequest is a single generated request for rule
|
||||
@@ -80,9 +76,8 @@ func (rule *Rule) Execute(input *ExecuteRuleInput) (err error) {
|
||||
|
||||
var finalComponentList []component.Component
|
||||
// match rule part with component name
|
||||
displayDebugFuzzPoints := make(map[string]map[string]string)
|
||||
for _, componentName := range component.Components {
|
||||
if !(rule.Part == componentName || sliceutil.Contains(rule.Parts, componentName) || rule.partType == requestPartType) {
|
||||
if rule.partType != requestPartType && rule.Part != componentName {
|
||||
continue
|
||||
}
|
||||
component := component.New(componentName)
|
||||
@@ -94,25 +89,12 @@ func (rule *Rule) Execute(input *ExecuteRuleInput) (err error) {
|
||||
if !discovered {
|
||||
continue
|
||||
}
|
||||
|
||||
// check rule applicable on this component
|
||||
if !rule.checkRuleApplicableOnComponent(component) {
|
||||
continue
|
||||
}
|
||||
// Debugging display for fuzz points
|
||||
if input.DisplayFuzzPoints {
|
||||
displayDebugFuzzPoints[componentName] = make(map[string]string)
|
||||
_ = component.Iterate(func(key string, value interface{}) error {
|
||||
displayDebugFuzzPoints[componentName][key] = fmt.Sprintf("%v", value)
|
||||
return nil
|
||||
})
|
||||
}
|
||||
finalComponentList = append(finalComponentList, component)
|
||||
}
|
||||
if len(displayDebugFuzzPoints) > 0 {
|
||||
marshalled, _ := json.MarshalIndent(displayDebugFuzzPoints, "", " ")
|
||||
gologger.Info().Msgf("[%s] Fuzz points for %s [%s]\n%s\n", rule.options.TemplateID, input.Input.MetaInput.Input, input.BaseRequest.Method, string(marshalled))
|
||||
}
|
||||
|
||||
if len(finalComponentList) == 0 {
|
||||
return ErrRuleNotApplicable.Msgf("no component matched on this rule")
|
||||
@@ -243,7 +225,7 @@ func (rule *Rule) executeRuleValues(input *ExecuteRuleInput, ruleComponent compo
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if gotErr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, "", ""); gotErr != nil {
|
||||
if gotErr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, ""); gotErr != nil {
|
||||
return gotErr
|
||||
}
|
||||
}
|
||||
@@ -279,9 +261,8 @@ func (rule *Rule) Compile(generator *generators.PayloadGenerator, options *proto
|
||||
} else {
|
||||
rule.partType = valueType
|
||||
}
|
||||
}
|
||||
if rule.Part == "" && len(rule.Parts) == 0 {
|
||||
return errors.Errorf("no part specified for rule")
|
||||
} else {
|
||||
rule.partType = queryPartType
|
||||
}
|
||||
|
||||
if rule.Type != "" {
|
||||
|
||||
@@ -1,152 +0,0 @@
|
||||
package frequency
|
||||
|
||||
import (
|
||||
"net"
|
||||
"net/url"
|
||||
"os"
|
||||
"strings"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
|
||||
"github.com/bluele/gcache"
|
||||
"github.com/projectdiscovery/gologger"
|
||||
)
|
||||
|
||||
// Tracker implements a frequency tracker for a given input
|
||||
// which is used to determine uninteresting input parameters
|
||||
// which are not that interesting from fuzzing perspective for a template
|
||||
// and target combination.
|
||||
//
|
||||
// This is used to reduce the number of requests made during fuzzing
|
||||
// for parameters that are less likely to give results for a rule.
|
||||
type Tracker struct {
|
||||
frequencies gcache.Cache
|
||||
paramOccurenceThreshold int
|
||||
|
||||
isDebug bool
|
||||
}
|
||||
|
||||
const (
|
||||
DefaultMaxTrackCount = 10000
|
||||
DefaultParamOccurenceThreshold = 10
|
||||
)
|
||||
|
||||
type cacheItem struct {
|
||||
errors atomic.Int32
|
||||
sync.Once
|
||||
}
|
||||
|
||||
// New creates a new frequency tracker with a given maximum
|
||||
// number of params to track in LRU fashion with a max error threshold
|
||||
func New(maxTrackCount, paramOccurenceThreshold int) *Tracker {
|
||||
gc := gcache.New(maxTrackCount).ARC().Build()
|
||||
|
||||
var isDebug bool
|
||||
if os.Getenv("FREQ_DEBUG") != "" {
|
||||
isDebug = true
|
||||
}
|
||||
return &Tracker{
|
||||
isDebug: isDebug,
|
||||
frequencies: gc,
|
||||
paramOccurenceThreshold: paramOccurenceThreshold,
|
||||
}
|
||||
}
|
||||
|
||||
func (t *Tracker) Close() {
|
||||
t.frequencies.Purge()
|
||||
}
|
||||
|
||||
// MarkParameter marks a parameter as frequently occuring once.
|
||||
//
|
||||
// The logic requires a parameter to be marked as frequently occuring
|
||||
// multiple times before it's considered as frequently occuring.
|
||||
func (t *Tracker) MarkParameter(parameter, target, template string) {
|
||||
normalizedTarget := normalizeTarget(target)
|
||||
key := getFrequencyKey(parameter, normalizedTarget, template)
|
||||
|
||||
if t.isDebug {
|
||||
gologger.Verbose().Msgf("[%s] Marking %s as found uninteresting", template, key)
|
||||
}
|
||||
|
||||
existingCacheItem, err := t.frequencies.GetIFPresent(key)
|
||||
if err != nil || existingCacheItem == nil {
|
||||
newItem := &cacheItem{errors: atomic.Int32{}}
|
||||
newItem.errors.Store(1)
|
||||
_ = t.frequencies.Set(key, newItem)
|
||||
return
|
||||
}
|
||||
existingCacheItemValue := existingCacheItem.(*cacheItem)
|
||||
existingCacheItemValue.errors.Add(1)
|
||||
|
||||
_ = t.frequencies.Set(key, existingCacheItemValue)
|
||||
}
|
||||
|
||||
// IsParameterFrequent checks if a parameter is frequently occuring
|
||||
// in the input with no much results.
|
||||
func (t *Tracker) IsParameterFrequent(parameter, target, template string) bool {
|
||||
normalizedTarget := normalizeTarget(target)
|
||||
key := getFrequencyKey(parameter, normalizedTarget, template)
|
||||
|
||||
if t.isDebug {
|
||||
gologger.Verbose().Msgf("[%s] Checking if %s is frequently found uninteresting", template, key)
|
||||
}
|
||||
|
||||
existingCacheItem, err := t.frequencies.GetIFPresent(key)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
existingCacheItemValue := existingCacheItem.(*cacheItem)
|
||||
|
||||
if existingCacheItemValue.errors.Load() >= int32(t.paramOccurenceThreshold) {
|
||||
existingCacheItemValue.Do(func() {
|
||||
gologger.Verbose().Msgf("[%s] Skipped %s from parameter for %s as found uninteresting %d times", template, parameter, target, existingCacheItemValue.errors.Load())
|
||||
})
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// UnmarkParameter unmarks a parameter as frequently occuring. This carries
|
||||
// more weight and resets the frequency counter for the parameter causing
|
||||
// it to be checked again. This is done when results are found.
|
||||
func (t *Tracker) UnmarkParameter(parameter, target, template string) {
|
||||
normalizedTarget := normalizeTarget(target)
|
||||
key := getFrequencyKey(parameter, normalizedTarget, template)
|
||||
|
||||
if t.isDebug {
|
||||
gologger.Verbose().Msgf("[%s] Unmarking %s as frequently found uninteresting", template, key)
|
||||
}
|
||||
|
||||
_ = t.frequencies.Remove(key)
|
||||
}
|
||||
|
||||
func getFrequencyKey(parameter, target, template string) string {
|
||||
var sb strings.Builder
|
||||
sb.WriteString(target)
|
||||
sb.WriteString(":")
|
||||
sb.WriteString(template)
|
||||
sb.WriteString(":")
|
||||
sb.WriteString(parameter)
|
||||
str := sb.String()
|
||||
return str
|
||||
}
|
||||
|
||||
func normalizeTarget(value string) string {
|
||||
finalValue := value
|
||||
if strings.HasPrefix(value, "http") {
|
||||
if parsed, err := url.Parse(value); err == nil {
|
||||
hostname := parsed.Host
|
||||
finalPort := parsed.Port()
|
||||
if finalPort == "" {
|
||||
if parsed.Scheme == "https" {
|
||||
finalPort = "443"
|
||||
} else {
|
||||
finalPort = "80"
|
||||
}
|
||||
hostname = net.JoinHostPort(parsed.Host, finalPort)
|
||||
}
|
||||
finalValue = hostname
|
||||
}
|
||||
}
|
||||
return finalValue
|
||||
}
|
||||
+2
-17
@@ -24,27 +24,12 @@ type Rule struct {
|
||||
ruleType ruleType
|
||||
// description: |
|
||||
// Part is the part of request to fuzz.
|
||||
//
|
||||
// query fuzzes the query part of url. More parts will be added later.
|
||||
// values:
|
||||
// - "query"
|
||||
// - "header"
|
||||
// - "path"
|
||||
// - "body"
|
||||
// - "cookie"
|
||||
// - "request"
|
||||
Part string `yaml:"part,omitempty" json:"part,omitempty" jsonschema:"title=part of rule,description=Part of request rule to fuzz,enum=query,enum=header,enum=path,enum=body,enum=cookie,enum=request"`
|
||||
partType partType
|
||||
// description: |
|
||||
// Parts is the list of parts to fuzz. If multiple parts need to be
|
||||
// defined while excluding some, this should be used instead of singular part.
|
||||
// values:
|
||||
// - "query"
|
||||
// - "header"
|
||||
// - "path"
|
||||
// - "body"
|
||||
// - "cookie"
|
||||
// - "request"
|
||||
Parts []string `yaml:"parts,omitempty" json:"parts,omitempty" jsonschema:"title=parts of rule,description=Part of request rule to fuzz,enum=query,enum=header,enum=path,enum=body,enum=cookie,enum=request"`
|
||||
|
||||
// description: |
|
||||
// Mode is the mode of fuzzing to perform.
|
||||
//
|
||||
|
||||
@@ -7,9 +7,7 @@ import (
|
||||
)
|
||||
|
||||
func TestRuleMatchKeyOrValue(t *testing.T) {
|
||||
rule := &Rule{
|
||||
Part: "query",
|
||||
}
|
||||
rule := &Rule{}
|
||||
err := rule.Compile(nil, nil)
|
||||
require.NoError(t, err, "could not compile rule")
|
||||
|
||||
@@ -17,7 +15,7 @@ func TestRuleMatchKeyOrValue(t *testing.T) {
|
||||
require.True(t, result, "could not get correct result")
|
||||
|
||||
t.Run("key", func(t *testing.T) {
|
||||
rule := &Rule{Keys: []string{"url"}, Part: "query"}
|
||||
rule := &Rule{Keys: []string{"url"}}
|
||||
err := rule.Compile(nil, nil)
|
||||
require.NoError(t, err, "could not compile rule")
|
||||
|
||||
@@ -27,7 +25,7 @@ func TestRuleMatchKeyOrValue(t *testing.T) {
|
||||
require.False(t, result, "could not get correct result")
|
||||
})
|
||||
t.Run("value", func(t *testing.T) {
|
||||
rule := &Rule{ValuesRegex: []string{`https?:\/\/?([-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,6}\b)*(\/[\/\d\w\.-]*)*(?:[\?])*(.+)*`}, Part: "query"}
|
||||
rule := &Rule{ValuesRegex: []string{`https?:\/\/?([-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,6}\b)*(\/[\/\d\w\.-]*)*(?:[\?])*(.+)*`}}
|
||||
err := rule.Compile(nil, nil)
|
||||
require.NoError(t, err, "could not compile rule")
|
||||
|
||||
|
||||
+5
-23
@@ -2,7 +2,6 @@ package fuzz
|
||||
|
||||
import (
|
||||
"io"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/fuzz/component"
|
||||
@@ -10,7 +9,6 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/generators"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/types"
|
||||
"github.com/projectdiscovery/retryablehttp-go"
|
||||
sliceutil "github.com/projectdiscovery/utils/slice"
|
||||
)
|
||||
|
||||
// executePartRule executes part rules based on type
|
||||
@@ -20,7 +18,7 @@ func (rule *Rule) executePartRule(input *ExecuteRuleInput, payload ValueOrKeyVal
|
||||
|
||||
// checkRuleApplicableOnComponent checks if a rule is applicable on given component
|
||||
func (rule *Rule) checkRuleApplicableOnComponent(component component.Component) bool {
|
||||
if rule.Part != component.Name() && !sliceutil.Contains(rule.Parts, component.Name()) && rule.partType != requestPartType {
|
||||
if rule.Part != component.Name() {
|
||||
return false
|
||||
}
|
||||
foundAny := false
|
||||
@@ -70,7 +68,7 @@ func (rule *Rule) executePartComponentOnValues(input *ExecuteRuleInput, payloadS
|
||||
return err
|
||||
}
|
||||
|
||||
if qerr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, key, valueStr); qerr != nil {
|
||||
if qerr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, key); qerr != nil {
|
||||
return qerr
|
||||
}
|
||||
// fmt.Printf("executed with value: %s\n", evaluated)
|
||||
@@ -92,7 +90,7 @@ func (rule *Rule) executePartComponentOnValues(input *ExecuteRuleInput, payloadS
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if qerr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, "", ""); qerr != nil {
|
||||
if qerr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, ""); qerr != nil {
|
||||
err = qerr
|
||||
return err
|
||||
}
|
||||
@@ -127,7 +125,7 @@ func (rule *Rule) executePartComponentOnKV(input *ExecuteRuleInput, payload Valu
|
||||
return err
|
||||
}
|
||||
|
||||
if qerr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, key, value); qerr != nil {
|
||||
if qerr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, key); qerr != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
@@ -146,23 +144,7 @@ func (rule *Rule) executePartComponentOnKV(input *ExecuteRuleInput, payload Valu
|
||||
}
|
||||
|
||||
// execWithInput executes a rule with input via callback
|
||||
func (rule *Rule) execWithInput(input *ExecuteRuleInput, httpReq *retryablehttp.Request, interactURLs []string, component component.Component, parameter, parameterValue string) error {
|
||||
// If the parameter is a number, replace it with the parameter value
|
||||
// or if the parameter is empty and the parameter value is not empty
|
||||
// replace it with the parameter value
|
||||
if _, err := strconv.Atoi(parameter); err == nil || (parameter == "" && parameterValue != "") {
|
||||
parameter = parameterValue
|
||||
}
|
||||
// If the parameter is frequent, skip it if the option is enabled
|
||||
if rule.options.FuzzParamsFrequency != nil {
|
||||
if rule.options.FuzzParamsFrequency.IsParameterFrequent(
|
||||
parameter,
|
||||
httpReq.URL.String(),
|
||||
rule.options.TemplateID,
|
||||
) {
|
||||
return nil
|
||||
}
|
||||
}
|
||||
func (rule *Rule) execWithInput(input *ExecuteRuleInput, httpReq *retryablehttp.Request, interactURLs []string, component component.Component, parameter string) error {
|
||||
request := GeneratedRequest{
|
||||
Request: httpReq,
|
||||
InteractURLs: interactURLs,
|
||||
|
||||
@@ -123,15 +123,11 @@ func (rr *RequestResponse) UnmarshalJSON(data []byte) error {
|
||||
if err := json.Unmarshal(data, &m); err != nil {
|
||||
return err
|
||||
}
|
||||
urlStrRaw, ok := m["url"]
|
||||
urlStr, ok := m["url"]
|
||||
if !ok {
|
||||
return fmt.Errorf("missing url in request response")
|
||||
}
|
||||
var urlStr string
|
||||
if err := json.Unmarshal(urlStrRaw, &urlStr); err != nil {
|
||||
return err
|
||||
}
|
||||
parsed, err := urlutil.ParseAbsoluteURL(urlStr, false)
|
||||
parsed, err := urlutil.ParseAbsoluteURL(string(urlStr), false)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
@@ -65,26 +65,3 @@ func TestParseHttpRequest(t *testing.T) {
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestUnmarshalJSON(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
rawJSONStr string
|
||||
expectedURLStr string
|
||||
}{
|
||||
{"basic url", `{"url": "example.com"}`, "example.com"},
|
||||
{"basic url with scheme", `{"url": "http://example.com"}`, "http://example.com"},
|
||||
}
|
||||
for _, tc := range tests {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
var rr RequestResponse
|
||||
err := rr.UnmarshalJSON([]byte(tc.rawJSONStr))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if tc.expectedURLStr != "" {
|
||||
require.Equal(t, rr.URL.String(), tc.expectedURLStr)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -87,7 +87,6 @@ func doVersionCheck(isSDK bool) error {
|
||||
// and according our config we have idle connections which are shown as leaked by goleak in tests
|
||||
// i.e we close all idle connections after our use and it doesn't affect any other part of the code
|
||||
defer retryableHttpClient.HTTPClient.CloseIdleConnections()
|
||||
|
||||
resp, err := retryableHttpClient.Get(pdtmNucleiVersionEndpoint + "?" + getpdtmParams(isSDK))
|
||||
if err != nil {
|
||||
return err
|
||||
|
||||
+8
-14
@@ -33,7 +33,6 @@ import (
|
||||
"github.com/projectdiscovery/utils/errkit"
|
||||
fileutil "github.com/projectdiscovery/utils/file"
|
||||
osutils "github.com/projectdiscovery/utils/os"
|
||||
unitutils "github.com/projectdiscovery/utils/unit"
|
||||
urlutil "github.com/projectdiscovery/utils/url"
|
||||
)
|
||||
|
||||
@@ -304,14 +303,13 @@ func (w *StandardWriter) Write(event *ResultEvent) error {
|
||||
|
||||
// JSONLogRequest is a trace/error log request written to file
|
||||
type JSONLogRequest struct {
|
||||
Template string `json:"template"`
|
||||
Type string `json:"type"`
|
||||
Input string `json:"input"`
|
||||
Timestamp *time.Time `json:"timestamp,omitempty"`
|
||||
Address string `json:"address"`
|
||||
Error string `json:"error"`
|
||||
Kind string `json:"kind,omitempty"`
|
||||
Attrs interface{} `json:"attrs,omitempty"`
|
||||
Template string `json:"template"`
|
||||
Type string `json:"type"`
|
||||
Input string `json:"input"`
|
||||
Address string `json:"address"`
|
||||
Error string `json:"error"`
|
||||
Kind string `json:"kind,omitempty"`
|
||||
Attrs interface{} `json:"attrs,omitempty"`
|
||||
}
|
||||
|
||||
// Request writes a log the requests trace log
|
||||
@@ -324,10 +322,6 @@ func (w *StandardWriter) Request(templatePath, input, requestType string, reques
|
||||
Input: input,
|
||||
Type: requestType,
|
||||
}
|
||||
if w.timestamp {
|
||||
ts := time.Now()
|
||||
request.Timestamp = &ts
|
||||
}
|
||||
parsed, _ := urlutil.ParseAbsoluteURL(input, false)
|
||||
if parsed != nil {
|
||||
request.Address = parsed.Hostname()
|
||||
@@ -455,7 +449,7 @@ func (w *StandardWriter) WriteFailure(wrappedEvent *InternalWrappedEvent) error
|
||||
return w.Write(data)
|
||||
}
|
||||
|
||||
var maxTemplateFileSizeForEncoding = unitutils.Mega
|
||||
var maxTemplateFileSizeForEncoding = 1024 * 1024
|
||||
|
||||
func (w *StandardWriter) encodeTemplate(templatePath string) string {
|
||||
data, err := os.ReadFile(templatePath)
|
||||
|
||||
@@ -32,14 +32,13 @@ import (
|
||||
sliceutil "github.com/projectdiscovery/utils/slice"
|
||||
stringsutil "github.com/projectdiscovery/utils/strings"
|
||||
syncutil "github.com/projectdiscovery/utils/sync"
|
||||
unitutils "github.com/projectdiscovery/utils/unit"
|
||||
wappalyzer "github.com/projectdiscovery/wappalyzergo"
|
||||
"gopkg.in/yaml.v2"
|
||||
)
|
||||
|
||||
const (
|
||||
mappingFilename = "wappalyzer-mapping.yml"
|
||||
maxDefaultBody = 4 * unitutils.Mega
|
||||
maxDefaultBody = 4 * 1024 * 1024 // 4MB
|
||||
)
|
||||
|
||||
// Options contains configuration options for automatic scan service
|
||||
|
||||
@@ -25,19 +25,8 @@ func New(payloads map[string]interface{}, attackType AttackType, templatePath st
|
||||
|
||||
// Resolve payload paths if they are files.
|
||||
payloadsFinal := make(map[string]interface{})
|
||||
for payloadName, v := range payloads {
|
||||
switch value := v.(type) {
|
||||
case map[interface{}]interface{}:
|
||||
values, err := parsePayloadsWithAggression(payloadName, value, opts.FuzzAggressionLevel)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "could not parse payloads with aggression")
|
||||
}
|
||||
for k, v := range values {
|
||||
payloadsFinal[k] = v
|
||||
}
|
||||
default:
|
||||
payloadsFinal[payloadName] = v
|
||||
}
|
||||
for name, payload := range payloads {
|
||||
payloadsFinal[name] = payload
|
||||
}
|
||||
|
||||
generator := &PayloadGenerator{catalog: catalog, options: opts}
|
||||
@@ -68,60 +57,6 @@ func New(payloads map[string]interface{}, attackType AttackType, templatePath st
|
||||
return generator, nil
|
||||
}
|
||||
|
||||
type aggressionLevelToPayloads struct {
|
||||
Low []interface{}
|
||||
Medium []interface{}
|
||||
High []interface{}
|
||||
}
|
||||
|
||||
// parsePayloadsWithAggression parses the payloads with the aggression level
|
||||
//
|
||||
// Three agression are supported -
|
||||
// - low
|
||||
// - medium
|
||||
// - high
|
||||
//
|
||||
// low is the default level. If medium is specified, all templates from
|
||||
// low and medium are executed. Similarly with high, including all templates
|
||||
// from low, medium, high.
|
||||
func parsePayloadsWithAggression(name string, v map[interface{}]interface{}, agression string) (map[string]interface{}, error) {
|
||||
payloadsLevels := &aggressionLevelToPayloads{}
|
||||
|
||||
for k, v := range v {
|
||||
if _, ok := v.([]interface{}); !ok {
|
||||
return nil, errors.Errorf("only lists are supported for aggression levels payloads")
|
||||
}
|
||||
var ok bool
|
||||
switch k {
|
||||
case "low":
|
||||
payloadsLevels.Low, ok = v.([]interface{})
|
||||
case "medium":
|
||||
payloadsLevels.Medium, ok = v.([]interface{})
|
||||
case "high":
|
||||
payloadsLevels.High, ok = v.([]interface{})
|
||||
default:
|
||||
return nil, errors.Errorf("invalid aggression level %s specified for %s", k, name)
|
||||
}
|
||||
if !ok {
|
||||
return nil, errors.Errorf("invalid aggression level %s specified for %s", k, name)
|
||||
}
|
||||
}
|
||||
|
||||
payloads := make(map[string]interface{})
|
||||
switch agression {
|
||||
case "low":
|
||||
payloads[name] = payloadsLevels.Low
|
||||
case "medium":
|
||||
payloads[name] = append(payloadsLevels.Low, payloadsLevels.Medium...)
|
||||
case "high":
|
||||
payloads[name] = append(payloadsLevels.Low, payloadsLevels.Medium...)
|
||||
payloads[name] = append(payloads[name].([]interface{}), payloadsLevels.High...)
|
||||
default:
|
||||
return nil, errors.Errorf("invalid aggression level %s specified for %s", agression, name)
|
||||
}
|
||||
return payloads, nil
|
||||
}
|
||||
|
||||
// Iterator is a single instance of an iterator for a generator structure
|
||||
type Iterator struct {
|
||||
Type AttackType
|
||||
|
||||
@@ -1,11 +1,9 @@
|
||||
package generators
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/require"
|
||||
"gopkg.in/yaml.v2"
|
||||
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/catalog/disk"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/types"
|
||||
@@ -92,49 +90,3 @@ func getOptions(allowLocalFileAccess bool) *types.Options {
|
||||
opts.AllowLocalFileAccess = allowLocalFileAccess
|
||||
return opts
|
||||
}
|
||||
|
||||
func TestParsePayloadsWithAggression(t *testing.T) {
|
||||
testPayload := `linux_path:
|
||||
low:
|
||||
- /etc/passwd
|
||||
medium:
|
||||
- ../etc/passwd
|
||||
- ../../etc/passwd
|
||||
high:
|
||||
- ../../../etc/passwd
|
||||
- ../../../../etc/passwd
|
||||
- ../../../../../etc/passwd`
|
||||
|
||||
var payloads map[string]interface{}
|
||||
err := yaml.NewDecoder(strings.NewReader(testPayload)).Decode(&payloads)
|
||||
require.Nil(t, err, "could not unmarshal yaml")
|
||||
|
||||
aggressionsToValues := map[string][]string{
|
||||
"low": {
|
||||
"/etc/passwd",
|
||||
},
|
||||
"medium": {
|
||||
"/etc/passwd",
|
||||
"../etc/passwd",
|
||||
"../../etc/passwd",
|
||||
},
|
||||
"high": {
|
||||
"/etc/passwd",
|
||||
"../etc/passwd",
|
||||
"../../etc/passwd",
|
||||
"../../../etc/passwd",
|
||||
"../../../../etc/passwd",
|
||||
"../../../../../etc/passwd",
|
||||
},
|
||||
}
|
||||
|
||||
for k, v := range payloads {
|
||||
for aggression, values := range aggressionsToValues {
|
||||
parsed, err := parsePayloadsWithAggression(k, v.(map[interface{}]interface{}), aggression)
|
||||
require.Nil(t, err, "could not parse payloads with aggression")
|
||||
|
||||
gotValues := parsed[k].([]interface{})
|
||||
require.Equal(t, len(values), len(gotValues), "could not get correct number of values")
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@ import (
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
|
||||
"github.com/Mzack9999/gcache"
|
||||
"github.com/bluele/gcache"
|
||||
"github.com/projectdiscovery/gologger"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/contextargs"
|
||||
@@ -37,7 +37,7 @@ var (
|
||||
type Cache struct {
|
||||
MaxHostError int
|
||||
verbose bool
|
||||
failedTargets gcache.Cache[string, *cacheItem]
|
||||
failedTargets gcache.Cache
|
||||
TrackError []string
|
||||
}
|
||||
|
||||
@@ -52,7 +52,7 @@ const DefaultMaxHostsCount = 10000
|
||||
|
||||
// New returns a new host max errors cache
|
||||
func New(maxHostError, maxHostsCount int, trackError []string) *Cache {
|
||||
gc := gcache.New[string, *cacheItem](maxHostsCount).
|
||||
gc := gcache.New(maxHostsCount).
|
||||
ARC().
|
||||
Build()
|
||||
return &Cache{failedTargets: gc, MaxHostError: maxHostError, TrackError: trackError}
|
||||
@@ -67,7 +67,11 @@ func (c *Cache) SetVerbose(verbose bool) {
|
||||
func (c *Cache) Close() {
|
||||
if config.DefaultConfig.IsDebugArgEnabled(config.DebugArgHostErrorStats) {
|
||||
items := c.failedTargets.GetALL(false)
|
||||
for k, val := range items {
|
||||
for k, v := range items {
|
||||
val, ok := v.(*cacheItem)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
gologger.Info().Label("MaxHostErrorStats").Msgf("Host: %s, Errors: %d", k, val.errors.Load())
|
||||
}
|
||||
}
|
||||
@@ -111,15 +115,16 @@ func (c *Cache) Check(ctx *contextargs.Context) bool {
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
if existingCacheItem.isPermanentErr {
|
||||
existingCacheItemValue := existingCacheItem.(*cacheItem)
|
||||
if existingCacheItemValue.isPermanentErr {
|
||||
// skipping permanent errors is expected so verbose instead of info
|
||||
gologger.Verbose().Msgf("Skipped %s from target list as found unresponsive permanently: %s", finalValue, existingCacheItem.cause)
|
||||
gologger.Verbose().Msgf("Skipped %s from target list as found unresponsive permanently: %s", finalValue, existingCacheItemValue.cause)
|
||||
return true
|
||||
}
|
||||
|
||||
if existingCacheItem.errors.Load() >= int32(c.MaxHostError) {
|
||||
existingCacheItem.Do(func() {
|
||||
gologger.Info().Msgf("Skipped %s from target list as found unresponsive %d times", finalValue, existingCacheItem.errors.Load())
|
||||
if existingCacheItemValue.errors.Load() >= int32(c.MaxHostError) {
|
||||
existingCacheItemValue.Do(func() {
|
||||
gologger.Info().Msgf("Skipped %s from target list as found unresponsive %d times", finalValue, existingCacheItemValue.errors.Load())
|
||||
})
|
||||
return true
|
||||
}
|
||||
@@ -146,8 +151,9 @@ func (c *Cache) MarkFailed(ctx *contextargs.Context, err error) {
|
||||
_ = c.failedTargets.Set(finalValue, newItem)
|
||||
return
|
||||
}
|
||||
existingCacheItem.errors.Add(1)
|
||||
_ = c.failedTargets.Set(finalValue, existingCacheItem)
|
||||
existingCacheItemValue := existingCacheItem.(*cacheItem)
|
||||
existingCacheItemValue.errors.Add(1)
|
||||
_ = c.failedTargets.Set(finalValue, existingCacheItemValue)
|
||||
}
|
||||
|
||||
// GetKeyFromContext returns the key for the cache from the context
|
||||
@@ -179,7 +185,6 @@ func (c *Cache) checkError(err error) bool {
|
||||
if err == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
kind := errkit.GetErrorKind(err, nucleierr.ErrTemplateLogic)
|
||||
switch kind {
|
||||
case nucleierr.ErrTemplateLogic:
|
||||
@@ -196,7 +201,7 @@ func (c *Cache) checkError(err error) bool {
|
||||
// these should not be counted as host errors
|
||||
return false
|
||||
default:
|
||||
// parse error for further processing
|
||||
// parse error for furthur processing
|
||||
errX := errkit.FromError(err)
|
||||
tmp := errX.Cause()
|
||||
cause := tmp.Error()
|
||||
|
||||
@@ -91,7 +91,9 @@ func TestCacheMarkFailed(t *testing.T) {
|
||||
require.Nil(t, err)
|
||||
require.NotNil(t, failedTarget)
|
||||
|
||||
require.EqualValues(t, test.expected, failedTarget.errors.Load())
|
||||
value, ok := failedTarget.(*cacheItem)
|
||||
require.True(t, ok)
|
||||
require.EqualValues(t, test.expected, value.errors.Load())
|
||||
}
|
||||
}
|
||||
|
||||
@@ -136,7 +138,9 @@ func TestCacheMarkFailedConcurrent(t *testing.T) {
|
||||
require.Nil(t, err)
|
||||
require.NotNil(t, failedTarget)
|
||||
|
||||
require.EqualValues(t, test.expected, failedTarget.errors.Load())
|
||||
value, ok := failedTarget.(*cacheItem)
|
||||
require.True(t, ok)
|
||||
require.EqualValues(t, test.expected, value.errors.Load())
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -21,7 +21,6 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/output"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/helpers/responsehighlighter"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/helpers/writer"
|
||||
"github.com/projectdiscovery/retryablehttp-go"
|
||||
errorutil "github.com/projectdiscovery/utils/errors"
|
||||
stringsutil "github.com/projectdiscovery/utils/strings"
|
||||
)
|
||||
@@ -181,14 +180,6 @@ func (c *Client) processInteractionForRequest(interaction *server.Interaction, d
|
||||
gologger.DefaultLogger.Print().Msgf("[Interactsh]: got result %v and status %v after processing interaction", result, matched)
|
||||
}
|
||||
|
||||
if c.options.FuzzParamsFrequency != nil {
|
||||
if !matched {
|
||||
c.options.FuzzParamsFrequency.MarkParameter(data.Parameter, data.Request.URL.String(), data.Operators.TemplateID)
|
||||
} else {
|
||||
c.options.FuzzParamsFrequency.UnmarkParameter(data.Parameter, data.Request.URL.String(), data.Operators.TemplateID)
|
||||
}
|
||||
}
|
||||
|
||||
// if we don't match, return
|
||||
if !matched || result == nil {
|
||||
return false
|
||||
@@ -329,9 +320,6 @@ type RequestData struct {
|
||||
Operators *operators.Operators
|
||||
MatchFunc operators.MatchFunc
|
||||
ExtractFunc operators.ExtractFunc
|
||||
|
||||
Parameter string
|
||||
Request *retryablehttp.Request
|
||||
}
|
||||
|
||||
// RequestEvent is the event for a network request sent by nuclei.
|
||||
|
||||
@@ -4,7 +4,6 @@ import (
|
||||
"time"
|
||||
|
||||
"github.com/projectdiscovery/interactsh/pkg/client"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/fuzz/frequency"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/output"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/progress"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/reporting"
|
||||
@@ -47,9 +46,8 @@ type Options struct {
|
||||
// NoColor disables printing colors for matches
|
||||
NoColor bool
|
||||
|
||||
FuzzParamsFrequency *frequency.Tracker
|
||||
StopAtFirstMatch bool
|
||||
HTTPClient *retryablehttp.Client
|
||||
StopAtFirstMatch bool
|
||||
HTTPClient *retryablehttp.Client
|
||||
}
|
||||
|
||||
// DefaultOptions returns the default options for interactsh client
|
||||
|
||||
@@ -38,5 +38,6 @@ func Init(options *types.Options) error {
|
||||
}
|
||||
|
||||
func Close() {
|
||||
protocolstate.Close()
|
||||
protocolstate.Dialer.Close()
|
||||
protocolstate.Dialer = nil
|
||||
}
|
||||
@@ -22,10 +22,6 @@ var (
|
||||
Dialer *fastdialer.Dialer
|
||||
)
|
||||
|
||||
func ShouldInit() bool {
|
||||
return Dialer == nil
|
||||
}
|
||||
|
||||
// Init creates the Dialer instance based on user configuration
|
||||
func Init(options *types.Options) error {
|
||||
if Dialer != nil {
|
||||
@@ -216,6 +212,5 @@ func Close() {
|
||||
Dialer.Close()
|
||||
Dialer = nil
|
||||
}
|
||||
Dialer = nil
|
||||
StopActiveMemGuardian()
|
||||
}
|
||||
@@ -1,24 +1,27 @@
|
||||
package dns
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/cespare/xxhash"
|
||||
)
|
||||
|
||||
|
||||
// TmplClusterKey generates a unique key for the request
|
||||
// to be used in the clustering process.
|
||||
func (request *Request) TmplClusterKey() uint64 {
|
||||
recursion := ""
|
||||
if request.Recursion != nil {
|
||||
recursion = fmt.Sprintf("%t", *request.Recursion)
|
||||
// CanCluster returns true if the request can be clustered.
|
||||
//
|
||||
// This used by the clustering engine to decide whether two requests
|
||||
// are similar enough to be considered one and can be checked by
|
||||
// just adding the matcher/extractors for the request and the correct IDs.
|
||||
func (request *Request) CanCluster(other *Request) bool {
|
||||
if len(request.Resolvers) > 0 || request.Trace || request.ID != "" {
|
||||
return false
|
||||
}
|
||||
inp := fmt.Sprintf("%s-%d-%d-%d-%s", request.Name, request.class, request.Retries, request.question, recursion)
|
||||
return xxhash.Sum64String(inp)
|
||||
}
|
||||
|
||||
// IsClusterable returns true if the request is eligible to be clustered.
|
||||
func (request *Request) IsClusterable() bool {
|
||||
return !(len(request.Resolvers) > 0 || request.Trace || request.ID != "")
|
||||
if request.Name != other.Name ||
|
||||
request.class != other.class ||
|
||||
request.Retries != other.Retries ||
|
||||
request.question != other.question {
|
||||
return false
|
||||
}
|
||||
if request.Recursion != nil {
|
||||
if other.Recursion == nil {
|
||||
return false
|
||||
}
|
||||
if *request.Recursion != *other.Recursion {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
@@ -1,21 +1,30 @@
|
||||
package http
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/cespare/xxhash"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/utils"
|
||||
sliceutil "github.com/projectdiscovery/utils/slice"
|
||||
"golang.org/x/exp/maps"
|
||||
)
|
||||
|
||||
// TmplClusterKey generates a unique key for the request
|
||||
// to be used in the clustering process.
|
||||
func (request *Request) TmplClusterKey() uint64 {
|
||||
inp := fmt.Sprintf("%s-%d-%t-%t-%s-%d", request.Method.String(), request.MaxRedirects, request.DisableCookie, request.Redirects, strings.Join(request.Path, "-"), utils.MapHash(request.Headers))
|
||||
return xxhash.Sum64String(inp)
|
||||
}
|
||||
|
||||
// IsClusterable returns true if the request is eligible to be clustered.
|
||||
func (request *Request) IsClusterable() bool {
|
||||
return !(len(request.Payloads) > 0 || len(request.Fuzzing) > 0 || len(request.Raw) > 0 || len(request.Body) > 0 || request.Unsafe || request.NeedsRequestCondition() || request.Name != "")
|
||||
// CanCluster returns true if the request can be clustered.
|
||||
//
|
||||
// This used by the clustering engine to decide whether two requests
|
||||
// are similar enough to be considered one and can be checked by
|
||||
// just adding the matcher/extractors for the request and the correct IDs.
|
||||
func (request *Request) CanCluster(other *Request) bool {
|
||||
if len(request.Payloads) > 0 || len(request.Fuzzing) > 0 || len(request.Raw) > 0 || len(request.Body) > 0 || request.Unsafe || request.NeedsRequestCondition() || request.Name != "" {
|
||||
return false
|
||||
}
|
||||
if request.Method != other.Method ||
|
||||
request.MaxRedirects != other.MaxRedirects ||
|
||||
request.DisableCookie != other.DisableCookie ||
|
||||
request.Redirects != other.Redirects {
|
||||
return false
|
||||
}
|
||||
if !sliceutil.Equal(request.Path, other.Path) {
|
||||
return false
|
||||
}
|
||||
if !maps.Equal(request.Headers, other.Headers) {
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
@@ -8,11 +8,8 @@ import (
|
||||
|
||||
func TestCanCluster(t *testing.T) {
|
||||
req := &Request{Unsafe: true}
|
||||
require.False(t, req.IsClusterable(), "could cluster unsafe request")
|
||||
require.False(t, req.CanCluster(&Request{}), "could cluster unsafe request")
|
||||
|
||||
req = &Request{Path: []string{"{{BaseURL}}"}, Method: HTTPMethodTypeHolder{MethodType: HTTPGet}}
|
||||
newReq := &Request{Path: []string{"{{BaseURL}}"}, Method: HTTPMethodTypeHolder{MethodType: HTTPGet}}
|
||||
require.True(t, req.IsClusterable(), "could not cluster GET request")
|
||||
require.True(t, req.IsClusterable(), "could not cluster GET request")
|
||||
require.Equal(t, req.TmplClusterKey(), newReq.TmplClusterKey(), "cluster keys should be equal")
|
||||
require.True(t, req.CanCluster(&Request{Path: []string{"{{BaseURL}}"}, Method: HTTPMethodTypeHolder{MethodType: HTTPGet}}), "could not cluster GET request")
|
||||
}
|
||||
@@ -16,6 +16,7 @@ import (
|
||||
"golang.org/x/net/proxy"
|
||||
"golang.org/x/net/publicsuffix"
|
||||
|
||||
"github.com/projectdiscovery/fastdialer/fastdialer"
|
||||
"github.com/projectdiscovery/fastdialer/fastdialer/ja3/impersonate"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/protocolstate"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/utils"
|
||||
@@ -27,6 +28,9 @@ import (
|
||||
)
|
||||
|
||||
var (
|
||||
// Dialer is a copy of the fastdialer from protocolstate
|
||||
Dialer *fastdialer.Dialer
|
||||
|
||||
rawHttpClient *rawhttp.Client
|
||||
forceMaxRedirects int
|
||||
normalClient *retryablehttp.Client
|
||||
@@ -150,8 +154,8 @@ func GetRawHTTP(options *types.Options) *rawhttp.Client {
|
||||
rawHttpOptions.Proxy = types.ProxyURL
|
||||
} else if types.ProxySocksURL != "" {
|
||||
rawHttpOptions.Proxy = types.ProxySocksURL
|
||||
} else if protocolstate.Dialer != nil {
|
||||
rawHttpOptions.FastDialer = protocolstate.Dialer
|
||||
} else if Dialer != nil {
|
||||
rawHttpOptions.FastDialer = Dialer
|
||||
}
|
||||
rawHttpOptions.Timeout = GetHttpTimeout(options)
|
||||
rawHttpClient = rawhttp.NewClient(rawHttpOptions)
|
||||
@@ -171,6 +175,10 @@ func Get(options *types.Options, configuration *Configuration) (*retryablehttp.C
|
||||
func wrappedGet(options *types.Options, configuration *Configuration) (*retryablehttp.Client, error) {
|
||||
var err error
|
||||
|
||||
if Dialer == nil {
|
||||
Dialer = protocolstate.Dialer
|
||||
}
|
||||
|
||||
hash := configuration.Hash()
|
||||
if client, ok := clientPool.Get(hash); ok {
|
||||
return client, nil
|
||||
@@ -246,15 +254,15 @@ func wrappedGet(options *types.Options, configuration *Configuration) (*retryabl
|
||||
|
||||
transport := &http.Transport{
|
||||
ForceAttemptHTTP2: options.ForceAttemptHTTP2,
|
||||
DialContext: protocolstate.Dialer.Dial,
|
||||
DialContext: Dialer.Dial,
|
||||
DialTLSContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
|
||||
if options.TlsImpersonate {
|
||||
return protocolstate.Dialer.DialTLSWithConfigImpersonate(ctx, network, addr, tlsConfig, impersonate.Random, nil)
|
||||
return Dialer.DialTLSWithConfigImpersonate(ctx, network, addr, tlsConfig, impersonate.Random, nil)
|
||||
}
|
||||
if options.HasClientCertificates() || options.ForceAttemptHTTP2 {
|
||||
return protocolstate.Dialer.DialTLSWithConfig(ctx, network, addr, tlsConfig)
|
||||
return Dialer.DialTLSWithConfig(ctx, network, addr, tlsConfig)
|
||||
}
|
||||
return protocolstate.Dialer.DialTLS(ctx, network, addr)
|
||||
return Dialer.DialTLS(ctx, network, addr)
|
||||
},
|
||||
MaxIdleConns: maxIdleConns,
|
||||
MaxIdleConnsPerHost: maxIdleConnsPerHost,
|
||||
|
||||
@@ -7,7 +7,6 @@ import (
|
||||
"time"
|
||||
|
||||
"github.com/projectdiscovery/rawhttp"
|
||||
urlutil "github.com/projectdiscovery/utils/url"
|
||||
)
|
||||
|
||||
// WithCustomTimeout is a configuration for custom timeout
|
||||
@@ -40,27 +39,7 @@ func SendRawRequest(client *rawhttp.Client, opts *RawHttpRequestOpts) (*http.Res
|
||||
// this error is caused when rawhttp client sends a corrupted or malformed request packet to server
|
||||
// some servers may attempt gracefully shutdown but most will just abruptly close the connection which results
|
||||
// in a connection reset by peer error and this can be safely assumed as 400 Bad Request in terms of normal http flow
|
||||
req, reqErr := http.NewRequest(opts.Method, opts.URL, opts.Body)
|
||||
if reqErr != nil {
|
||||
// failed to build new request mostly because of invalid url or body
|
||||
// try again or else return urlErr
|
||||
parsed, urlErr := urlutil.ParseAbsoluteURL(opts.URL, true)
|
||||
if urlErr != nil {
|
||||
return nil, err
|
||||
}
|
||||
req, reqErr = http.NewRequest(opts.Method, parsed.Host, opts.Body)
|
||||
if reqErr != nil {
|
||||
return nil, err
|
||||
}
|
||||
req.URL = parsed.URL
|
||||
req.Header = opts.Headers
|
||||
}
|
||||
|
||||
// if req is still nil, return error
|
||||
if req == nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
req, _ := http.NewRequest(opts.Method, opts.URL, opts.Body)
|
||||
req.Header = opts.Headers
|
||||
resp = &http.Response{
|
||||
Request: req,
|
||||
|
||||
@@ -44,7 +44,6 @@ import (
|
||||
"github.com/projectdiscovery/utils/reader"
|
||||
sliceutil "github.com/projectdiscovery/utils/slice"
|
||||
stringsutil "github.com/projectdiscovery/utils/strings"
|
||||
unitutils "github.com/projectdiscovery/utils/unit"
|
||||
urlutil "github.com/projectdiscovery/utils/url"
|
||||
)
|
||||
|
||||
@@ -56,7 +55,7 @@ const (
|
||||
)
|
||||
|
||||
var (
|
||||
MaxBodyRead = 10 * unitutils.Mega
|
||||
MaxBodyRead = int64(10 * 1024 * 1024) // 10MB
|
||||
// ErrMissingVars is error occured when variables are missing
|
||||
ErrMissingVars = errkit.New("stop execution due to unresolved variables").SetKind(nucleierr.ErrTemplateLogic).Build()
|
||||
// ErrHttpEngineRequestDeadline is error occured when request deadline set by http request engine is exceeded
|
||||
@@ -598,7 +597,7 @@ func (request *Request) ExecuteWithResults(input *contextargs.Context, dynamicVa
|
||||
return requestErr
|
||||
}
|
||||
|
||||
const drainReqSize = int64(8 * unitutils.Kilo)
|
||||
const drainReqSize = int64(8 * 1024)
|
||||
|
||||
// executeRequest executes the actual generated request and returns error if occurred
|
||||
func (request *Request) executeRequest(input *contextargs.Context, generatedRequest *generatedRequest, previousEvent output.InternalEvent, hasInteractMatchers bool, processEvent protocols.OutputEventCallback, requestCount int) (err error) {
|
||||
@@ -843,7 +842,7 @@ func (request *Request) executeRequest(input *contextargs.Context, generatedRequ
|
||||
if input.MetaInput.CustomIP != "" {
|
||||
outputEvent["ip"] = input.MetaInput.CustomIP
|
||||
} else {
|
||||
outputEvent["ip"] = protocolstate.Dialer.GetDialedIP(hostname)
|
||||
outputEvent["ip"] = httpclientpool.Dialer.GetDialedIP(hostname)
|
||||
}
|
||||
|
||||
if len(generatedRequest.interactshURLs) > 0 {
|
||||
@@ -876,15 +875,15 @@ func (request *Request) executeRequest(input *contextargs.Context, generatedRequ
|
||||
// define max body read limit
|
||||
maxBodylimit := MaxBodyRead // 10MB
|
||||
if request.MaxSize > 0 {
|
||||
maxBodylimit = request.MaxSize
|
||||
maxBodylimit = int64(request.MaxSize)
|
||||
}
|
||||
if request.options.Options.ResponseReadSize != 0 {
|
||||
maxBodylimit = request.options.Options.ResponseReadSize
|
||||
maxBodylimit = int64(request.options.Options.ResponseReadSize)
|
||||
}
|
||||
|
||||
// respChain is http response chain that reads response body
|
||||
// efficiently by reusing buffers and does all decoding and optimizations
|
||||
respChain := httpUtils.NewResponseChain(resp, int64(maxBodylimit))
|
||||
respChain := httpUtils.NewResponseChain(resp, maxBodylimit)
|
||||
defer respChain.Close() // reuse buffers
|
||||
|
||||
// we only intend to log/save the final redirected response
|
||||
@@ -939,7 +938,7 @@ func (request *Request) executeRequest(input *contextargs.Context, generatedRequ
|
||||
if input.MetaInput.CustomIP != "" {
|
||||
outputEvent["ip"] = input.MetaInput.CustomIP
|
||||
} else {
|
||||
outputEvent["ip"] = protocolstate.Dialer.GetDialedIP(hostname)
|
||||
outputEvent["ip"] = httpclientpool.Dialer.GetDialedIP(hostname)
|
||||
}
|
||||
if request.options.Interactsh != nil {
|
||||
request.options.Interactsh.MakePlaceholders(generatedRequest.interactshURLs, outputEvent)
|
||||
|
||||
@@ -120,8 +120,7 @@ func (request *Request) executeAllFuzzingRules(input *contextargs.Context, value
|
||||
}
|
||||
|
||||
err := rule.Execute(&fuzz.ExecuteRuleInput{
|
||||
Input: input,
|
||||
DisplayFuzzPoints: request.options.Options.DisplayFuzzPoints,
|
||||
Input: input,
|
||||
Callback: func(gr fuzz.GeneratedRequest) bool {
|
||||
select {
|
||||
case <-input.Context().Done():
|
||||
@@ -140,7 +139,6 @@ func (request *Request) executeAllFuzzingRules(input *contextargs.Context, value
|
||||
continue
|
||||
}
|
||||
if fuzz.IsErrRuleNotApplicable(err) {
|
||||
gologger.Verbose().Msgf("[%s] fuzz: rule not applicable : %s\n", request.options.TemplateID, err)
|
||||
continue
|
||||
}
|
||||
if err == types.ErrNoMoreRequests {
|
||||
@@ -178,7 +176,6 @@ func (request *Request) executeGeneratedFuzzingRequest(gr fuzz.GeneratedRequest,
|
||||
result.FuzzingPosition = gr.Component.Name()
|
||||
}
|
||||
|
||||
setInteractshCallback := false
|
||||
if hasInteractMarkers && hasInteractMatchers && request.options.Interactsh != nil {
|
||||
requestData := &interactsh.RequestData{
|
||||
MakeResultFunc: request.MakeResultEvent,
|
||||
@@ -186,10 +183,7 @@ func (request *Request) executeGeneratedFuzzingRequest(gr fuzz.GeneratedRequest,
|
||||
Operators: request.CompiledOperators,
|
||||
MatchFunc: request.Match,
|
||||
ExtractFunc: request.Extract,
|
||||
Parameter: gr.Parameter,
|
||||
Request: gr.Request,
|
||||
}
|
||||
setInteractshCallback = true
|
||||
request.options.Interactsh.RequestEvent(gr.InteractURLs, requestData)
|
||||
gotMatches = request.options.Interactsh.AlreadyMatched(requestData)
|
||||
} else {
|
||||
@@ -199,13 +193,6 @@ func (request *Request) executeGeneratedFuzzingRequest(gr fuzz.GeneratedRequest,
|
||||
if event.OperatorsResult != nil {
|
||||
gotMatches = event.OperatorsResult.Matched
|
||||
}
|
||||
if request.options.FuzzParamsFrequency != nil && !setInteractshCallback {
|
||||
if !gotMatches {
|
||||
request.options.FuzzParamsFrequency.MarkParameter(gr.Parameter, gr.Request.URL.String(), request.options.TemplateID)
|
||||
} else {
|
||||
request.options.FuzzParamsFrequency.UnmarkParameter(gr.Parameter, gr.Request.URL.String(), request.options.TemplateID)
|
||||
}
|
||||
}
|
||||
}, 0)
|
||||
// If a variable is unresolved, skip all further requests
|
||||
if errors.Is(requestErr, ErrMissingVars) {
|
||||
|
||||
@@ -17,12 +17,11 @@ import (
|
||||
templateTypes "github.com/projectdiscovery/nuclei/v3/pkg/templates/types"
|
||||
"github.com/projectdiscovery/utils/conversion"
|
||||
syncutil "github.com/projectdiscovery/utils/sync"
|
||||
unitutils "github.com/projectdiscovery/utils/unit"
|
||||
)
|
||||
|
||||
var _ protocols.Request = &Request{}
|
||||
|
||||
const maxSize = 5 * unitutils.Mega
|
||||
const maxSize = 5 * 1024 * 1024
|
||||
|
||||
// Type returns the type of the protocol request
|
||||
func (request *Request) Type() templateTypes.ProtocolType {
|
||||
|
||||
@@ -13,7 +13,6 @@ import (
|
||||
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/authprovider"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/catalog"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/fuzz/frequency"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/input"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/js/compiler"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/loader/parser"
|
||||
@@ -34,11 +33,10 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/scan"
|
||||
templateTypes "github.com/projectdiscovery/nuclei/v3/pkg/templates/types"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/types"
|
||||
unitutils "github.com/projectdiscovery/utils/unit"
|
||||
)
|
||||
|
||||
var (
|
||||
MaxTemplateFileSizeForEncoding = unitutils.Mega
|
||||
MaxTemplateFileSizeForEncoding = 1024 * 1024
|
||||
)
|
||||
|
||||
// Executer is an interface implemented any protocol based request executer.
|
||||
@@ -94,8 +92,6 @@ type ExecutorOptions struct {
|
||||
ExcludeMatchers *excludematchers.ExcludeMatchers
|
||||
// InputHelper is a helper for input normalization
|
||||
InputHelper *input.Helper
|
||||
// FuzzParamsFrequency is a cache for parameter frequency
|
||||
FuzzParamsFrequency *frequency.Tracker
|
||||
|
||||
Operators []*operators.Operators // only used by offlinehttp module
|
||||
|
||||
|
||||
@@ -3,10 +3,8 @@ package ssl
|
||||
import (
|
||||
"fmt"
|
||||
"net"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/cespare/xxhash"
|
||||
"github.com/fatih/structs"
|
||||
jsoniter "github.com/json-iterator/go"
|
||||
"github.com/pkg/errors"
|
||||
@@ -101,15 +99,15 @@ type Request struct {
|
||||
options *protocols.ExecutorOptions
|
||||
}
|
||||
|
||||
// TmplClusterKey generates a unique key for the request
|
||||
// to be used in the clustering process.
|
||||
func (request *Request) TmplClusterKey() uint64 {
|
||||
inp := fmt.Sprintf("%s-%s-%t-%t-%s", request.Address, request.ScanMode, request.TLSCiphersEnum, request.TLSVersionsEnum, strings.Join(request.TLSCipherTypes, ","))
|
||||
return xxhash.Sum64String(inp)
|
||||
}
|
||||
|
||||
func (request *Request) IsClusterable() bool {
|
||||
return !(len(request.CipherSuites) > 0 || request.MinVersion != "" || request.MaxVersion != "")
|
||||
// CanCluster returns true if the request can be clustered.
|
||||
func (request *Request) CanCluster(other *Request) bool {
|
||||
if len(request.CipherSuites) > 0 || request.MinVersion != "" || request.MaxVersion != "" {
|
||||
return false
|
||||
}
|
||||
if request.Address != other.Address || request.ScanMode != other.ScanMode {
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// Compile compiles the request generators preparing any requests possible.
|
||||
|
||||
@@ -12,7 +12,6 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/reporting/exporters/markdown/util"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/types"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/utils"
|
||||
unitutils "github.com/projectdiscovery/utils/unit"
|
||||
)
|
||||
|
||||
// Summary returns a formatted built one line summary of the event
|
||||
@@ -72,7 +71,7 @@ func CreateReportDescription(event *output.ResultEvent, formatter ResultFormatte
|
||||
if event.Response != "" {
|
||||
var responseString string
|
||||
// If the response is larger than 5 kb, truncate it before writing.
|
||||
maxKbSize := 5 * unitutils.Kilo
|
||||
maxKbSize := 5 * 1024
|
||||
if len(event.Response) > maxKbSize {
|
||||
responseString = event.Response[:maxKbSize]
|
||||
responseString += ".... Truncated ...."
|
||||
|
||||
@@ -273,7 +273,7 @@ func (c *ReportingClient) CreateIssue(event *output.ResultEvent) error {
|
||||
|
||||
for _, tracker := range c.trackers {
|
||||
// process tracker specific allow/deny list
|
||||
if !tracker.ShouldFilter(event) {
|
||||
if tracker.ShouldFilter(event) {
|
||||
continue
|
||||
}
|
||||
|
||||
|
||||
@@ -139,15 +139,15 @@ func (i *Integration) CloseIssue(event *output.ResultEvent) error {
|
||||
|
||||
// ShouldFilter determines if an issue should be logged to this tracker
|
||||
func (i *Integration) ShouldFilter(event *output.ResultEvent) bool {
|
||||
if i.options.AllowList != nil && !i.options.AllowList.GetMatch(event) {
|
||||
if i.options.AllowList != nil && i.options.AllowList.GetMatch(event) {
|
||||
return false
|
||||
}
|
||||
|
||||
if i.options.DenyList != nil && i.options.DenyList.GetMatch(event) {
|
||||
return false
|
||||
return true
|
||||
}
|
||||
|
||||
return true
|
||||
return false
|
||||
}
|
||||
|
||||
func (i *Integration) findIssueByTitle(title string) (*gitea.Issue, error) {
|
||||
|
||||
@@ -175,15 +175,15 @@ func (i *Integration) Name() string {
|
||||
|
||||
// ShouldFilter determines if an issue should be logged to this tracker
|
||||
func (i *Integration) ShouldFilter(event *output.ResultEvent) bool {
|
||||
if i.options.AllowList != nil && !i.options.AllowList.GetMatch(event) {
|
||||
if i.options.AllowList != nil && i.options.AllowList.GetMatch(event) {
|
||||
return false
|
||||
}
|
||||
|
||||
if i.options.DenyList != nil && i.options.DenyList.GetMatch(event) {
|
||||
return false
|
||||
return true
|
||||
}
|
||||
|
||||
return true
|
||||
return false
|
||||
}
|
||||
|
||||
func (i *Integration) findIssueByTitle(ctx context.Context, title string) (*github.Issue, error) {
|
||||
|
||||
@@ -164,13 +164,13 @@ func (i *Integration) CloseIssue(event *output.ResultEvent) error {
|
||||
|
||||
// ShouldFilter determines if an issue should be logged to this tracker
|
||||
func (i *Integration) ShouldFilter(event *output.ResultEvent) bool {
|
||||
if i.options.AllowList != nil && !i.options.AllowList.GetMatch(event) {
|
||||
if i.options.AllowList != nil && i.options.AllowList.GetMatch(event) {
|
||||
return false
|
||||
}
|
||||
|
||||
if i.options.DenyList != nil && i.options.DenyList.GetMatch(event) {
|
||||
return false
|
||||
return true
|
||||
}
|
||||
|
||||
return true
|
||||
return false
|
||||
}
|
||||
@@ -16,7 +16,6 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/reporting/format"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/reporting/trackers/filters"
|
||||
"github.com/projectdiscovery/retryablehttp-go"
|
||||
"github.com/projectdiscovery/utils/ptr"
|
||||
)
|
||||
|
||||
type Formatter struct {
|
||||
@@ -148,13 +147,13 @@ func (i *Integration) CreateNewIssue(event *output.ResultEvent) (*filters.Create
|
||||
nestedValue = strings.TrimPrefix(fmtNestedValue, "$")
|
||||
switch nestedValue {
|
||||
case "CVSSMetrics":
|
||||
nestedValue = ptr.Safe(event.Info.Classification).CVSSMetrics
|
||||
nestedValue = event.Info.Classification.CVSSMetrics
|
||||
case "CVEID":
|
||||
nestedValue = ptr.Safe(event.Info.Classification).CVEID
|
||||
nestedValue = event.Info.Classification.CVEID
|
||||
case "CWEID":
|
||||
nestedValue = ptr.Safe(event.Info.Classification).CWEID
|
||||
nestedValue = event.Info.Classification.CWEID
|
||||
case "CVSSScore":
|
||||
nestedValue = ptr.Safe(event.Info.Classification).CVSSScore
|
||||
nestedValue = event.Info.Classification.CVSSScore
|
||||
case "Host":
|
||||
nestedValue = event.Host
|
||||
case "Severity":
|
||||
@@ -315,13 +314,13 @@ func (i *Integration) FindExistingIssue(event *output.ResultEvent) (jira.Issue,
|
||||
|
||||
// ShouldFilter determines if an issue should be logged to this tracker
|
||||
func (i *Integration) ShouldFilter(event *output.ResultEvent) bool {
|
||||
if i.options.AllowList != nil && !i.options.AllowList.GetMatch(event) {
|
||||
if i.options.AllowList != nil && i.options.AllowList.GetMatch(event) {
|
||||
return false
|
||||
}
|
||||
|
||||
if i.options.DenyList != nil && i.options.DenyList.GetMatch(event) {
|
||||
return false
|
||||
return true
|
||||
}
|
||||
|
||||
return true
|
||||
return false
|
||||
}
|
||||
@@ -4,10 +4,6 @@ import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/model"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/model/types/severity"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/output"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/reporting/trackers/filters"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
@@ -40,33 +36,3 @@ func TestTableCreation(t *testing.T) {
|
||||
`
|
||||
require.Equal(t, expected, table)
|
||||
}
|
||||
|
||||
func Test_ShouldFilter_Tracker(t *testing.T) {
|
||||
jiraIntegration := &Integration{
|
||||
options: &Options{AllowList: &filters.Filter{
|
||||
Severities: severity.Severities{severity.Critical},
|
||||
}},
|
||||
}
|
||||
|
||||
require.False(t, jiraIntegration.ShouldFilter(&output.ResultEvent{Info: model.Info{
|
||||
SeverityHolder: severity.Holder{Severity: severity.Info},
|
||||
}}))
|
||||
require.True(t, jiraIntegration.ShouldFilter(&output.ResultEvent{Info: model.Info{
|
||||
SeverityHolder: severity.Holder{Severity: severity.Critical},
|
||||
}}))
|
||||
|
||||
t.Run("deny-list", func(t *testing.T) {
|
||||
jiraIntegration := &Integration{
|
||||
options: &Options{DenyList: &filters.Filter{
|
||||
Severities: severity.Severities{severity.Critical},
|
||||
}},
|
||||
}
|
||||
|
||||
require.True(t, jiraIntegration.ShouldFilter(&output.ResultEvent{Info: model.Info{
|
||||
SeverityHolder: severity.Holder{Severity: severity.Info},
|
||||
}}))
|
||||
require.False(t, jiraIntegration.ShouldFilter(&output.ResultEvent{Info: model.Info{
|
||||
SeverityHolder: severity.Holder{Severity: severity.Critical},
|
||||
}}))
|
||||
})
|
||||
}
|
||||
+69
-45
@@ -14,6 +14,7 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/scan"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/templates/types"
|
||||
cryptoutil "github.com/projectdiscovery/utils/crypto"
|
||||
mapsutil "github.com/projectdiscovery/utils/maps"
|
||||
)
|
||||
|
||||
// Cluster clusters a list of templates into a lesser number if possible based
|
||||
@@ -41,68 +42,91 @@ import (
|
||||
// Finally, the engine creates a single executer with a clusteredexecuter for all templates
|
||||
// in a cluster.
|
||||
func Cluster(list []*Template) [][]*Template {
|
||||
http := make(map[uint64][]*Template)
|
||||
dns := make(map[uint64][]*Template)
|
||||
ssl := make(map[uint64][]*Template)
|
||||
|
||||
final := [][]*Template{}
|
||||
skip := mapsutil.NewSyncLockMap[string, struct{}]()
|
||||
|
||||
// Split up templates that might be clusterable
|
||||
for _, template := range list {
|
||||
// it is not possible to cluster flow and multiprotocol due to dependent execution
|
||||
if template.Flow != "" || template.Options.IsMultiProtocol {
|
||||
key := template.Path
|
||||
|
||||
if skip.Has(key) {
|
||||
continue
|
||||
}
|
||||
|
||||
// We only cluster http, dns and ssl requests as of now.
|
||||
// Take care of requests that can't be clustered first.
|
||||
if len(template.RequestsHTTP) == 0 && len(template.RequestsDNS) == 0 && len(template.RequestsSSL) == 0 {
|
||||
_ = skip.Set(key, struct{}{})
|
||||
final = append(final, []*Template{template})
|
||||
continue
|
||||
}
|
||||
|
||||
// it is not possible to cluster flow and multiprotocol due to dependent execution
|
||||
if template.Flow != "" || template.Options.IsMultiProtocol {
|
||||
_ = skip.Set(key, struct{}{})
|
||||
final = append(final, []*Template{template})
|
||||
continue
|
||||
}
|
||||
|
||||
_ = skip.Set(key, struct{}{})
|
||||
|
||||
var templateType types.ProtocolType
|
||||
switch {
|
||||
case len(template.RequestsDNS) == 1:
|
||||
if template.RequestsDNS[0].IsClusterable() {
|
||||
hash := template.RequestsDNS[0].TmplClusterKey()
|
||||
if dns[hash] == nil {
|
||||
dns[hash] = []*Template{}
|
||||
}
|
||||
dns[hash] = append(dns[hash], template)
|
||||
} else {
|
||||
final = append(final, []*Template{template})
|
||||
templateType = types.DNSProtocol
|
||||
case len(template.RequestsHTTP) == 1:
|
||||
templateType = types.HTTPProtocol
|
||||
case len(template.RequestsSSL) == 1:
|
||||
templateType = types.SSLProtocol
|
||||
}
|
||||
|
||||
// Find any/all similar matching request that is identical to
|
||||
// this one and cluster them together for http protocol only.
|
||||
cluster := []*Template{}
|
||||
for _, other := range list {
|
||||
otherKey := other.Path
|
||||
|
||||
if skip.Has(otherKey) {
|
||||
continue
|
||||
}
|
||||
|
||||
case len(template.RequestsHTTP) == 1:
|
||||
if template.RequestsHTTP[0].IsClusterable() {
|
||||
hash := template.RequestsHTTP[0].TmplClusterKey()
|
||||
if http[hash] == nil {
|
||||
http[hash] = []*Template{}
|
||||
}
|
||||
http[hash] = append(http[hash], template)
|
||||
} else {
|
||||
final = append(final, []*Template{template})
|
||||
// it is not possible to cluster flow and multiprotocol due to dependent execution
|
||||
if other.Flow != "" || other.Options.IsMultiProtocol {
|
||||
_ = skip.Set(otherKey, struct{}{})
|
||||
final = append(final, []*Template{other})
|
||||
continue
|
||||
}
|
||||
case len(template.RequestsSSL) == 1:
|
||||
if template.RequestsSSL[0].IsClusterable() {
|
||||
hash := template.RequestsSSL[0].TmplClusterKey()
|
||||
if ssl[hash] == nil {
|
||||
ssl[hash] = []*Template{}
|
||||
|
||||
switch templateType {
|
||||
case types.DNSProtocol:
|
||||
if len(other.RequestsDNS) != 1 {
|
||||
continue
|
||||
} else if template.RequestsDNS[0].CanCluster(other.RequestsDNS[0]) {
|
||||
_ = skip.Set(otherKey, struct{}{})
|
||||
cluster = append(cluster, other)
|
||||
}
|
||||
case types.HTTPProtocol:
|
||||
if len(other.RequestsHTTP) != 1 {
|
||||
continue
|
||||
} else if template.RequestsHTTP[0].CanCluster(other.RequestsHTTP[0]) {
|
||||
_ = skip.Set(otherKey, struct{}{})
|
||||
cluster = append(cluster, other)
|
||||
}
|
||||
case types.SSLProtocol:
|
||||
if len(other.RequestsSSL) != 1 {
|
||||
continue
|
||||
} else if template.RequestsSSL[0].CanCluster(other.RequestsSSL[0]) {
|
||||
_ = skip.Set(otherKey, struct{}{})
|
||||
cluster = append(cluster, other)
|
||||
}
|
||||
ssl[hash] = append(ssl[hash], template)
|
||||
} else {
|
||||
final = append(final, []*Template{template})
|
||||
}
|
||||
default:
|
||||
}
|
||||
if len(cluster) > 0 {
|
||||
cluster = append(cluster, template)
|
||||
final = append(final, cluster)
|
||||
} else {
|
||||
final = append(final, []*Template{template})
|
||||
}
|
||||
}
|
||||
|
||||
// add all clusterd templates
|
||||
for _, templates := range http {
|
||||
final = append(final, templates)
|
||||
}
|
||||
for _, templates := range dns {
|
||||
final = append(final, templates)
|
||||
}
|
||||
for _, templates := range ssl {
|
||||
final = append(final, templates)
|
||||
}
|
||||
|
||||
return final
|
||||
}
|
||||
|
||||
|
||||
@@ -342,11 +342,6 @@ func parseTemplate(data []byte, options protocols.ExecutorOptions) (*Template, e
|
||||
return nil, errors.New("no template author field provided")
|
||||
}
|
||||
|
||||
numberOfWorkflows := len(template.Workflows)
|
||||
if numberOfWorkflows > 0 && numberOfWorkflows != template.Requests() {
|
||||
return nil, errors.New("workflows cannot have other protocols")
|
||||
}
|
||||
|
||||
// use default unknown severity
|
||||
if len(template.Workflows) == 0 {
|
||||
if template.Info.SeverityHolder.Severity == severity.Undefined {
|
||||
|
||||
@@ -197,12 +197,3 @@ func Test_WrongTemplate(t *testing.T) {
|
||||
require.Nil(t, got, "could not parse template")
|
||||
require.ErrorContains(t, err, "no requests defined ")
|
||||
}
|
||||
|
||||
func TestWrongWorkflow(t *testing.T) {
|
||||
setup()
|
||||
|
||||
filePath := "tests/workflow-invalid.yaml"
|
||||
got, err := templates.Parse(filePath, nil, executerOpts)
|
||||
require.Nil(t, got, "could not parse template")
|
||||
require.ErrorContains(t, err, "workflows cannot have other protocols")
|
||||
}
|
||||
@@ -23,7 +23,6 @@ import (
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/websocket"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/protocols/whois"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/templates/types"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/utils"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/workflows"
|
||||
errorutil "github.com/projectdiscovery/utils/errors"
|
||||
fileutil "github.com/projectdiscovery/utils/file"
|
||||
@@ -177,6 +176,8 @@ func (template *Template) Type() types.ProtocolType {
|
||||
return types.HeadlessProtocol
|
||||
case len(template.RequestsNetwork) > 0:
|
||||
return types.NetworkProtocol
|
||||
case len(template.Workflow.Workflows) > 0:
|
||||
return types.WorkflowProtocol
|
||||
case len(template.RequestsSSL) > 0:
|
||||
return types.SSLProtocol
|
||||
case len(template.RequestsWebsocket) > 0:
|
||||
@@ -187,8 +188,6 @@ func (template *Template) Type() types.ProtocolType {
|
||||
return types.CodeProtocol
|
||||
case len(template.RequestsJavascript) > 0:
|
||||
return types.JavascriptProtocol
|
||||
case len(template.Workflow.Workflows) > 0:
|
||||
return types.WorkflowProtocol
|
||||
default:
|
||||
return types.InvalidProtocol
|
||||
}
|
||||
@@ -327,17 +326,6 @@ func (template *Template) UnmarshalYAML(unmarshal func(interface{}) error) error
|
||||
}
|
||||
*template = Template(*alias)
|
||||
|
||||
if !ReTemplateID.MatchString(template.ID) {
|
||||
return errorutil.New("template id must match expression %v", ReTemplateID).WithTag("invalid template")
|
||||
}
|
||||
info := template.Info
|
||||
if utils.IsBlank(info.Name) {
|
||||
return errorutil.New("no template name field provided").WithTag("invalid template")
|
||||
}
|
||||
if info.Authors.IsEmpty() {
|
||||
return errorutil.New("no template author field provided").WithTag("invalid template")
|
||||
}
|
||||
|
||||
if len(template.RequestsHTTP) > 0 || len(template.RequestsNetwork) > 0 {
|
||||
_ = deprecatedProtocolNameTemplates.Set(template.ID, true)
|
||||
}
|
||||
|
||||
@@ -747,7 +747,7 @@ func init() {
|
||||
FieldName: "fuzzing",
|
||||
},
|
||||
}
|
||||
FUZZRuleDoc.Fields = make([]encoder.Doc, 9)
|
||||
FUZZRuleDoc.Fields = make([]encoder.Doc, 8)
|
||||
FUZZRuleDoc.Fields[0].Name = "type"
|
||||
FUZZRuleDoc.Fields[0].Type = "string"
|
||||
FUZZRuleDoc.Fields[0].Note = ""
|
||||
@@ -762,69 +762,51 @@ func init() {
|
||||
FUZZRuleDoc.Fields[1].Name = "part"
|
||||
FUZZRuleDoc.Fields[1].Type = "string"
|
||||
FUZZRuleDoc.Fields[1].Note = ""
|
||||
FUZZRuleDoc.Fields[1].Description = "Part is the part of request to fuzz."
|
||||
FUZZRuleDoc.Fields[1].Description = "Part is the part of request to fuzz.\n\nquery fuzzes the query part of url. More parts will be added later."
|
||||
FUZZRuleDoc.Fields[1].Comments[encoder.LineComment] = "Part is the part of request to fuzz."
|
||||
FUZZRuleDoc.Fields[1].Values = []string{
|
||||
"query",
|
||||
"header",
|
||||
"path",
|
||||
"body",
|
||||
"cookie",
|
||||
"request",
|
||||
}
|
||||
FUZZRuleDoc.Fields[2].Name = "parts"
|
||||
FUZZRuleDoc.Fields[2].Type = "[]string"
|
||||
FUZZRuleDoc.Fields[2].Name = "mode"
|
||||
FUZZRuleDoc.Fields[2].Type = "string"
|
||||
FUZZRuleDoc.Fields[2].Note = ""
|
||||
FUZZRuleDoc.Fields[2].Description = "Parts is the list of parts to fuzz. If multiple parts need to be\ndefined while excluding some, this should be used instead of singular part."
|
||||
FUZZRuleDoc.Fields[2].Comments[encoder.LineComment] = "Parts is the list of parts to fuzz. If multiple parts need to be"
|
||||
FUZZRuleDoc.Fields[2].Description = "Mode is the mode of fuzzing to perform.\n\nsingle fuzzes one value at a time. multiple fuzzes all values at same time."
|
||||
FUZZRuleDoc.Fields[2].Comments[encoder.LineComment] = "Mode is the mode of fuzzing to perform."
|
||||
FUZZRuleDoc.Fields[2].Values = []string{
|
||||
"query",
|
||||
"header",
|
||||
"path",
|
||||
"body",
|
||||
"cookie",
|
||||
"request",
|
||||
}
|
||||
FUZZRuleDoc.Fields[3].Name = "mode"
|
||||
FUZZRuleDoc.Fields[3].Type = "string"
|
||||
FUZZRuleDoc.Fields[3].Note = ""
|
||||
FUZZRuleDoc.Fields[3].Description = "Mode is the mode of fuzzing to perform.\n\nsingle fuzzes one value at a time. multiple fuzzes all values at same time."
|
||||
FUZZRuleDoc.Fields[3].Comments[encoder.LineComment] = "Mode is the mode of fuzzing to perform."
|
||||
FUZZRuleDoc.Fields[3].Values = []string{
|
||||
"single",
|
||||
"multiple",
|
||||
}
|
||||
FUZZRuleDoc.Fields[4].Name = "keys"
|
||||
FUZZRuleDoc.Fields[3].Name = "keys"
|
||||
FUZZRuleDoc.Fields[3].Type = "[]string"
|
||||
FUZZRuleDoc.Fields[3].Note = ""
|
||||
FUZZRuleDoc.Fields[3].Description = "Keys is the optional list of key named parameters to fuzz."
|
||||
FUZZRuleDoc.Fields[3].Comments[encoder.LineComment] = "Keys is the optional list of key named parameters to fuzz."
|
||||
|
||||
FUZZRuleDoc.Fields[3].AddExample("Examples of keys", []string{"url", "file", "host"})
|
||||
FUZZRuleDoc.Fields[4].Name = "keys-regex"
|
||||
FUZZRuleDoc.Fields[4].Type = "[]string"
|
||||
FUZZRuleDoc.Fields[4].Note = ""
|
||||
FUZZRuleDoc.Fields[4].Description = "Keys is the optional list of key named parameters to fuzz."
|
||||
FUZZRuleDoc.Fields[4].Comments[encoder.LineComment] = "Keys is the optional list of key named parameters to fuzz."
|
||||
FUZZRuleDoc.Fields[4].Description = "KeysRegex is the optional list of regex key parameters to fuzz."
|
||||
FUZZRuleDoc.Fields[4].Comments[encoder.LineComment] = "KeysRegex is the optional list of regex key parameters to fuzz."
|
||||
|
||||
FUZZRuleDoc.Fields[4].AddExample("Examples of keys", []string{"url", "file", "host"})
|
||||
FUZZRuleDoc.Fields[5].Name = "keys-regex"
|
||||
FUZZRuleDoc.Fields[4].AddExample("Examples of key regex", []string{"url.*"})
|
||||
FUZZRuleDoc.Fields[5].Name = "values"
|
||||
FUZZRuleDoc.Fields[5].Type = "[]string"
|
||||
FUZZRuleDoc.Fields[5].Note = ""
|
||||
FUZZRuleDoc.Fields[5].Description = "KeysRegex is the optional list of regex key parameters to fuzz."
|
||||
FUZZRuleDoc.Fields[5].Comments[encoder.LineComment] = "KeysRegex is the optional list of regex key parameters to fuzz."
|
||||
FUZZRuleDoc.Fields[5].Description = "Values is the optional list of regex value parameters to fuzz."
|
||||
FUZZRuleDoc.Fields[5].Comments[encoder.LineComment] = "Values is the optional list of regex value parameters to fuzz."
|
||||
|
||||
FUZZRuleDoc.Fields[5].AddExample("Examples of key regex", []string{"url.*"})
|
||||
FUZZRuleDoc.Fields[6].Name = "values"
|
||||
FUZZRuleDoc.Fields[6].Type = "[]string"
|
||||
FUZZRuleDoc.Fields[5].AddExample("Examples of value regex", []string{"https?://.*"})
|
||||
FUZZRuleDoc.Fields[6].Name = "fuzz"
|
||||
FUZZRuleDoc.Fields[6].Type = "SliceOrMapSlice"
|
||||
FUZZRuleDoc.Fields[6].Note = ""
|
||||
FUZZRuleDoc.Fields[6].Description = "Values is the optional list of regex value parameters to fuzz."
|
||||
FUZZRuleDoc.Fields[6].Comments[encoder.LineComment] = "Values is the optional list of regex value parameters to fuzz."
|
||||
|
||||
FUZZRuleDoc.Fields[6].AddExample("Examples of value regex", []string{"https?://.*"})
|
||||
FUZZRuleDoc.Fields[7].Name = "fuzz"
|
||||
FUZZRuleDoc.Fields[7].Type = "SliceOrMapSlice"
|
||||
FUZZRuleDoc.Fields[6].Description = "description: |\n Fuzz is the list of payloads to perform substitutions with.\n examples:\n - name: Examples of fuzz\n value: >\n []string{\"{{ssrf}}\", \"{{interactsh-url}}\", \"example-value\"}\n or\n x-header: 1\n x-header: 2"
|
||||
FUZZRuleDoc.Fields[6].Comments[encoder.LineComment] = " description: |"
|
||||
FUZZRuleDoc.Fields[7].Name = "replace-regex"
|
||||
FUZZRuleDoc.Fields[7].Type = "string"
|
||||
FUZZRuleDoc.Fields[7].Note = ""
|
||||
FUZZRuleDoc.Fields[7].Description = "description: |\n Fuzz is the list of payloads to perform substitutions with.\n examples:\n - name: Examples of fuzz\n value: >\n []string{\"{{ssrf}}\", \"{{interactsh-url}}\", \"example-value\"}\n or\n x-header: 1\n x-header: 2"
|
||||
FUZZRuleDoc.Fields[7].Comments[encoder.LineComment] = " description: |"
|
||||
FUZZRuleDoc.Fields[8].Name = "replace-regex"
|
||||
FUZZRuleDoc.Fields[8].Type = "string"
|
||||
FUZZRuleDoc.Fields[8].Note = ""
|
||||
FUZZRuleDoc.Fields[8].Description = "replace-regex is regex for regex-replace rule type\nit is only required for replace-regex rule type"
|
||||
FUZZRuleDoc.Fields[8].Comments[encoder.LineComment] = "replace-regex is regex for regex-replace rule type"
|
||||
FUZZRuleDoc.Fields[7].Description = "replace-regex is regex for regex-replace rule type\nit is only required for replace-regex rule type"
|
||||
FUZZRuleDoc.Fields[7].Comments[encoder.LineComment] = "replace-regex is regex for regex-replace rule type"
|
||||
|
||||
SliceOrMapSliceDoc.Type = "SliceOrMapSlice"
|
||||
SliceOrMapSliceDoc.Comments[encoder.LineComment] = ""
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
id: workflow-example
|
||||
|
||||
info:
|
||||
name: Test Invalid Workflow Template
|
||||
author: pdteam
|
||||
severity: info
|
||||
|
||||
http:
|
||||
- raw:
|
||||
- |
|
||||
POST /re HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
{{code_response}}
|
||||
|
||||
workflows:
|
||||
- template: tests/match-1.yaml
|
||||
- template: tests/match-1.yaml
|
||||
@@ -27,7 +27,6 @@ func GetPlaygroundServer() *echo.Echo {
|
||||
e.GET("/request", requestHandler)
|
||||
e.GET("/email", emailHandler)
|
||||
e.GET("/permissions", permissionsHandler)
|
||||
|
||||
e.GET("/blog/post", numIdorHandler) // for num based idors like ?id=44
|
||||
e.POST("/reset-password", resetPasswordHandler)
|
||||
e.GET("/host-header-lab", hostHeaderLabHandler)
|
||||
@@ -48,20 +47,13 @@ var bodyTemplate = `<html>
|
||||
|
||||
func indexHandler(ctx echo.Context) error {
|
||||
return ctx.HTML(200, fmt.Sprintf(bodyTemplate, `<h1>Fuzzing Playground</h1><hr>
|
||||
<ul>
|
||||
|
||||
<li><a href="/info?name=test&another=value&random=data">Info Page XSS</a></li>
|
||||
<li><a href="/redirect?redirect_url=/info?name=redirected_from_url">Redirect Page OpenRedirect</a></li>
|
||||
<li><a href="/request?url=https://example.com">Request Page SSRF</a></li>
|
||||
<li><a href="/email?text=important_user">Email Page SSTI</a></li>
|
||||
<li><a href="/permissions?cmd=whoami">Permissions Page CMDI</a></li>
|
||||
|
||||
<li><a href="/host-header-lab">Host Header Lab (X-Forwarded-Host Trusted)</a></li>
|
||||
<li><a href="/user/75/profile">User Profile Page SQLI (path parameter)</a></li>
|
||||
<li><a href="/user">POST on /user SQLI (body parameter)</a></li>
|
||||
<li><a href="/blog/posts">SQLI in cookie lang parameter value (eg. lang=en)</a></li>
|
||||
|
||||
</ul>
|
||||
<ul>
|
||||
<li><a href="/info?name=test&another=value&random=data">Info Page XSS</a></li>
|
||||
<li><a href="/redirect?redirect_url=/info?name=redirected_from_url">Redirect Page OpenRedirect</a></li>
|
||||
<li><a href="/request?url=https://example.com">Request Page SSRF</a></li>
|
||||
<li><a href="/email?text=important_user">Email Page SSTI</a></li>
|
||||
<li><a href="/permissions?cmd=whoami">Permissions Page CMDI</a></li>
|
||||
</ul>
|
||||
`))
|
||||
}
|
||||
|
||||
|
||||
@@ -24,7 +24,6 @@ import (
|
||||
protocolUtils "github.com/projectdiscovery/nuclei/v3/pkg/protocols/utils"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/types"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/utils"
|
||||
unitutils "github.com/projectdiscovery/utils/unit"
|
||||
)
|
||||
|
||||
// Init initializes the protocols and their configurations
|
||||
@@ -204,7 +203,7 @@ func (m *MockOutputWriter) WriteFailure(wrappedEvent *output.InternalWrappedEven
|
||||
return m.Write(data)
|
||||
}
|
||||
|
||||
var maxTemplateFileSizeForEncoding = unitutils.Mega
|
||||
var maxTemplateFileSizeForEncoding = 1024 * 1024
|
||||
|
||||
func (w *MockOutputWriter) encodeTemplate(templatePath string) string {
|
||||
data, err := os.ReadFile(templatePath)
|
||||
|
||||
+2
-9
@@ -15,7 +15,6 @@ import (
|
||||
errorutil "github.com/projectdiscovery/utils/errors"
|
||||
fileutil "github.com/projectdiscovery/utils/file"
|
||||
folderutil "github.com/projectdiscovery/utils/folder"
|
||||
unitutils "github.com/projectdiscovery/utils/unit"
|
||||
)
|
||||
|
||||
var (
|
||||
@@ -364,12 +363,6 @@ type Options struct {
|
||||
FuzzingMode string
|
||||
// TlsImpersonate enables TLS impersonation
|
||||
TlsImpersonate bool
|
||||
// DisplayFuzzPoints enables display of fuzz points for fuzzing
|
||||
DisplayFuzzPoints bool
|
||||
// FuzzAggressionLevel is the level of fuzzing aggression (low, medium, high.)
|
||||
FuzzAggressionLevel string
|
||||
// FuzzParamFrequency is the frequency of fuzzing parameters
|
||||
FuzzParamFrequency int
|
||||
// CodeTemplateSignaturePublicKey is the custom public key used to verify the template signature (algorithm is automatically inferred from the length)
|
||||
CodeTemplateSignaturePublicKey string
|
||||
// CodeTemplateSignatureAlgorithm specifies the sign algorithm (rsa, ecdsa)
|
||||
@@ -442,8 +435,8 @@ func DefaultOptions() *Options {
|
||||
Timeout: 5,
|
||||
Retries: 1,
|
||||
MaxHostError: 30,
|
||||
ResponseReadSize: 10 * unitutils.Mega,
|
||||
ResponseSaveSize: unitutils.Mega,
|
||||
ResponseReadSize: 10 * 1024 * 1024,
|
||||
ResponseSaveSize: 1024 * 1024,
|
||||
ResponseReadTimeout: 5 * time.Second,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -16,7 +16,6 @@ import (
|
||||
"github.com/DataDog/gostackparse"
|
||||
"github.com/projectdiscovery/gologger"
|
||||
permissionutil "github.com/projectdiscovery/utils/permission"
|
||||
unitutils "github.com/projectdiscovery/utils/unit"
|
||||
"github.com/rs/xid"
|
||||
)
|
||||
|
||||
@@ -119,7 +118,7 @@ func (s *Agent) monitorWorker(cancel context.CancelFunc) {
|
||||
|
||||
// getStack returns full stack trace of the program
|
||||
var getStack = func(all bool) []byte {
|
||||
for i := unitutils.Mega; ; i *= 2 {
|
||||
for i := 1024 * 1024; ; i *= 2 {
|
||||
buf := make([]byte, i)
|
||||
if n := runtime.Stack(buf, all); n < i {
|
||||
return buf[:n-1]
|
||||
|
||||
+30
-16
@@ -2,22 +2,23 @@ package stats
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
|
||||
"github.com/logrusorgru/aurora"
|
||||
"github.com/projectdiscovery/gologger"
|
||||
mapsutil "github.com/projectdiscovery/utils/maps"
|
||||
)
|
||||
|
||||
// Storage is a storage for storing statistics information
|
||||
// about the nuclei engine displaying it at user-defined intervals.
|
||||
type Storage struct {
|
||||
data *mapsutil.SyncLockMap[string, *storageDataItem]
|
||||
data map[string]*storageDataItem
|
||||
mutex *sync.RWMutex
|
||||
}
|
||||
|
||||
type storageDataItem struct {
|
||||
description string
|
||||
value atomic.Int64
|
||||
value int64
|
||||
}
|
||||
|
||||
var Default *Storage
|
||||
@@ -58,32 +59,38 @@ func GetValue(name string) int64 {
|
||||
|
||||
// New creates a new storage object
|
||||
func New() *Storage {
|
||||
data := mapsutil.NewSyncLockMap[string, *storageDataItem]()
|
||||
return &Storage{data: data}
|
||||
return &Storage{data: make(map[string]*storageDataItem), mutex: &sync.RWMutex{}}
|
||||
}
|
||||
|
||||
// NewEntry creates a new entry in the storage object
|
||||
func (s *Storage) NewEntry(name, description string) {
|
||||
_ = s.data.Set(name, &storageDataItem{description: description, value: atomic.Int64{}})
|
||||
s.mutex.Lock()
|
||||
s.data[name] = &storageDataItem{description: description, value: 0}
|
||||
s.mutex.Unlock()
|
||||
}
|
||||
|
||||
// Increment increments the value for a name string
|
||||
func (s *Storage) Increment(name string) {
|
||||
data, ok := s.data.Get(name)
|
||||
s.mutex.RLock()
|
||||
data, ok := s.data[name]
|
||||
s.mutex.RUnlock()
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
data.value.Add(1)
|
||||
|
||||
atomic.AddInt64(&data.value, 1)
|
||||
}
|
||||
|
||||
// Display displays the stats for a name
|
||||
func (s *Storage) Display(name string) {
|
||||
data, ok := s.data.Get(name)
|
||||
s.mutex.RLock()
|
||||
data, ok := s.data[name]
|
||||
s.mutex.RUnlock()
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
|
||||
dataValue := data.value.Load()
|
||||
dataValue := atomic.LoadInt64(&data.value)
|
||||
if dataValue == 0 {
|
||||
return // don't show for nil stats
|
||||
}
|
||||
@@ -91,12 +98,14 @@ func (s *Storage) Display(name string) {
|
||||
}
|
||||
|
||||
func (s *Storage) DisplayAsWarning(name string) {
|
||||
data, ok := s.data.Get(name)
|
||||
s.mutex.RLock()
|
||||
data, ok := s.data[name]
|
||||
s.mutex.RUnlock()
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
|
||||
dataValue := data.value.Load()
|
||||
dataValue := atomic.LoadInt64(&data.value)
|
||||
if dataValue == 0 {
|
||||
return // don't show for nil stats
|
||||
}
|
||||
@@ -106,12 +115,14 @@ func (s *Storage) DisplayAsWarning(name string) {
|
||||
// ForceDisplayWarning forces the display of a warning
|
||||
// regardless of current verbosity level
|
||||
func (s *Storage) ForceDisplayWarning(name string) {
|
||||
data, ok := s.data.Get(name)
|
||||
s.mutex.RLock()
|
||||
data, ok := s.data[name]
|
||||
s.mutex.RUnlock()
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
|
||||
dataValue := data.value.Load()
|
||||
dataValue := atomic.LoadInt64(&data.value)
|
||||
if dataValue == 0 {
|
||||
return // don't show for nil stats
|
||||
}
|
||||
@@ -120,10 +131,13 @@ func (s *Storage) ForceDisplayWarning(name string) {
|
||||
|
||||
// GetValue returns the value for a set variable
|
||||
func (s *Storage) GetValue(name string) int64 {
|
||||
data, ok := s.data.Get(name)
|
||||
s.mutex.RLock()
|
||||
data, ok := s.data[name]
|
||||
s.mutex.RUnlock()
|
||||
if !ok {
|
||||
return 0
|
||||
}
|
||||
|
||||
return data.value.Load()
|
||||
dataValue := atomic.LoadInt64(&data.value)
|
||||
return dataValue
|
||||
}
|
||||
@@ -2,16 +2,12 @@ package utils
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/url"
|
||||
"strings"
|
||||
|
||||
"github.com/cespare/xxhash"
|
||||
"github.com/projectdiscovery/nuclei/v3/pkg/catalog"
|
||||
"github.com/projectdiscovery/retryablehttp-go"
|
||||
mapsutil "github.com/projectdiscovery/utils/maps"
|
||||
"golang.org/x/exp/constraints"
|
||||
)
|
||||
|
||||
func IsBlank(value string) bool {
|
||||
@@ -61,13 +57,3 @@ func StringSliceContains(slice []string, item string) bool {
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// MapHash generates a hash for any give map
|
||||
func MapHash[K constraints.Ordered, V any](m map[K]V) uint64 {
|
||||
keys := mapsutil.GetSortedKeys(m)
|
||||
var sb strings.Builder
|
||||
for _, k := range keys {
|
||||
sb.WriteString(fmt.Sprintf("%v:%v\n", k, m[k]))
|
||||
}
|
||||
return xxhash.Sum64([]byte(sb.String()))
|
||||
}
|
||||
Reference in new issue
Block a user