`hasMatchers` was not nil-safe when iterating over
the slice of operators. Check if the operator is
nil before accessing
`*operators.Operators.Matchers` to prevent a panic
when a protocol implementation returns a slice
containing a nil element.
This can happen when a request has no local
matchers/extractors but is processed in a flow
where global matchers are present.
Fixes#6738.
Signed-off-by: Dwi Siswanto <[email protected]>
The `connectWithDSN` func used `db.Exec()` which
implicitly uses `context.Background()`[1]. This
caused the registered "nucleitcp" dialer
callback to receive a ctx missing the
`executionId`, leading to a panic during type
assertion.
Refactor `connectWithDSN` to accept `executionId`
explicitly and use it to create a `context` for
`db.PingContext()` (yeah, instead of `db.Exec()`).
And, add a defensive check in the dialer callback
to handle nil values gracefully.
Fixes#6733 regression introduced in #6296.
[1]: "Exec uses `context.Background` internally" -
https://pkg.go.dev/database/sql#DB.Exec.
Signed-off-by: Dwi Siswanto <[email protected]>
Make sure postgres Exec/ExecContext are invoked with the correct
argument order, preventing context from being passed as the query.
* fixing pg syntax
* adding test
`MergeMaps` accounts for 11.41% of allocs (13.8
GB) in clusterbomb mode. With 1,305 combinations
per target, this function is called millions of
times in the hot path.
RCA:
* Request generator calls `MergeMaps` with single
arg on every payload combination, incurring
variadic overhead.
* Build request merges same maps multiple times
per request.
* `BuildPayloadFromOptions` recomputes static CLI
options on every call.
* Variables calls `MergeMaps` $$2×N$$ times per
variable evaluation (once in loop, once in
`evaluateVariableValue`)
Changes:
Core optimizations in maps.go:
* Pre-size merged map to avoid rehashing (30-40%
reduction)
* Add `CopyMap` for efficient single-map copy
without variadic overhead.
* Add `MergeMapsInto` for in-place mutation when
caller owns destination.
Hot path fixes:
* Replace `MergeMaps(r.currentPayloads)` with
`CopyMap(r.currentPayloads)` to eliminates
allocation on every combination iteration.
* Pre-allocate combined map once, extend in-place
during `ForEach` loop instead of creating new
map per variable (eliminates $$2×N$$ allocations
per request).
Caching with concurrency safety:
* Cache `BuildPayloadFromOptions` computation in
`sync.Map` keyed by `types.Options` ptr, but
return copy to prevent concurrent modification.
* Cost: shallow copy of ~10-20 entries vs. full
merge of vars + env (85-90% savings in typical
case)
* Clear cache in `closeInternal()` to prevent
memory leaks when SDK instances are created or
destroyed.
Estimated impact: 40-60% reduction in `MergeMaps`
allocations (5.5-8.3 GB savings from original
13.8 GB). Safe for concurrent execution and SDK
usage with multiple instances.
Signed-off-by: Dwi Siswanto <[email protected]>
* feat: add site-url to optionally provide jira server URL for oauth
* chore(cmd): add `site-url` config option
Adds optional `site-url` field to JIRA issue
tracker configuration for specifying browsable URL
when it differs from the API endpoint. This is
particularly useful for OAuth-based JIRA Cloud
integrations where `issue.Self` contains
"api.atlassian.com" instead of the user-facing
domain.
Signed-off-by: Dwi Siswanto <[email protected]>
---------
Signed-off-by: Dwi Siswanto <[email protected]>
Co-authored-by: Dwi Siswanto <[email protected]>
This patch enables TLS session resumption by
setting a shared LRU session cache
(`ClientSessionCache`) in all HTTP client TLS
configs. This reduces handshake overhead and CPU
usage for repeated conns to the same host,
improving throughput and efficiency in
clusterbomb/pitchfork modes.
This applied to HTTP-request-based and headless-
request-based protocols.
No runtime/compatibility impact.
Signed-off-by: Dwi Siswanto <[email protected]>
with configurable limits
This patch fixes duplicate issue detection for
GitLab trackers by implementing paginated search
with configurable page size and max pages. Adds
`duplicate-issue-page-size` and
`duplicate-issue-max-pages` options to the config.
Fixes#6711.
Signed-off-by: Dwi Siswanto <[email protected]>
Restore backwards compat for JavaScript protocol
templates that omit the `Port` argument.
Regression was introduced in f4f2e9f2, which
removed the fallback for empty `Port` in
`(*Request).ExecuteWithResults`, causing templates
without `Port` to be silently skipped.
Now, if no `Port` is specified, the engine
executes the JavaScript block using the target
URL's port.
Fixes#6708.
Signed-off-by: Dwi Siswanto <[email protected]>
Continue the fix from #6666 by converting
remaining direct Body assignments to use setter
methods:
* pkg/fuzz/component/body.go:139: use
`SetBodyReader()` in transfer-encoding path.
* pkg/protocols/http/request.go:694: use
`SetBodyString()` in fuzz component `Rebuild()`.
Fixes#6692.
Signed-off-by: Dwi Siswanto <[email protected]>
* fix(http): pass `dynamicValues` to `EvaluateWithInteractsh`
When `LazyEval` is true (triggered by `variables`
containing `BaseURL`, `Hostname`,
`interactsh-url`, etc.), variable expressions are not
eval'ed during YAML parsing & remain as raw exprs
like "{{rand_base(5)}}".
At request build time, `EvaluateWithInteractsh()`
checks if a variable already has a value in the
passed map before re-evaluating its expression.
But, `dynamicValues` (which contains the template
context with previously eval'ed values) was not
being passed, causing exprs like `rand_*` to be
re-evaluated on each request, producing different
values.
Fixes#6684 by including `dynamicValues` in the
map passed to `EvaluateWithInteractsh()`, so
variables evaluated in earlier requests retain
their values in subsequent requests.
Signed-off-by: Dwi Siswanto <[email protected]>
* chore(http): rm early eval in `(*Request).ExecuteWithResults()`
Signed-off-by: Dwi Siswanto <[email protected]>
* test: adds variables-threads-previous integration test
Signed-off-by: Dwi Siswanto <[email protected]>
* test: adds constants-with-threads integration test
Signed-off-by: Dwi Siswanto <[email protected]>
* test: adds race-with-variables integration test
Signed-off-by: Dwi Siswanto <[email protected]>
---------
Signed-off-by: Dwi Siswanto <[email protected]>
The `(*Page).HistoryData` was being read w/o
holding the mutex lock after
`(*Page).ExecuteActions()` returns, while the
background hijack goroutine could still be writing
to it via `(*Page).addToHistory()`.
Copy the first history item by value while holding
RLock to avoid racing with concurrent append ops.
Fixes#6686.
Signed-off-by: Dwi Siswanto <[email protected]>
Prev, `FullResponseString()`, `BodyString()`, and
`HeadersString()` were called multiple times per
HTTP response iteration, each call allocating a
new string copy of the response data.
For a 10MB response, this resulted in ~60MB of
redundant string allocs/response (6 calls x 10MB).
Cache the string representations once per `Fill()`
cycle and reuse them throughout the response
processing loop. This reduces allocs from 6 to 3
per response, cutting memory usage by ~50% for
response string handling.
Profiling showed these functions accounting for
~89% of heap allocs (5.7GB out of 6.17GB) during
large scans.
Signed-off-by: Dwi Siswanto <[email protected]>
Bump `github.com/ericlagergren/decimal` dep to
resolve an "undefined: c.MaxScale" error
encountered during build on linux/loong64 plat.
Fixes#6664.
Signed-off-by: Dwi Siswanto <[email protected]>
* fix(http): lost request body on retries & redirects
Updates the HTTP protocol to use
`(*retryablehttp.Request).SetBodyString` instead
of direct `Body` assignment.
This fixes#6665 where the request body was
dropped during retries or 307/308 redirects
because `GetBody` was not being populated.
Thanks to @zzyjsj for reporting the bug in the
upstream dependency and the hints!
Signed-off-by: Dwi Siswanto <[email protected]>
* empty: add co-author
Co-authored-by: zzy <[email protected]>
Signed-off-by: Dwi Siswanto <[email protected]>
---------
Signed-off-by: Dwi Siswanto <[email protected]>
Co-authored-by: zzy <[email protected]>
Prev, the template exclusion logic checked if the
full file path contained any of the known
miscellaneous directory names (e.g., helpers,
.git). This caused false positives when valid
templates were stored in paths where a parent
directory matched one of these names (e.g.,
/path/to/somewhere/that/has/helpers/dir/name/).
This commit introduces `IsTemplateWithRoot`, which
checks for excluded directories relative to a
provided root directory. It splits the relative
path into components.
Signed-off-by: Dwi Siswanto <[email protected]>
* fix(lib): segfault when init engine with `EnableHeadlessWithOpts`
The panic was caused by attempting to log a
sandbox warning before the logger was initialized.
RCA:
* SDK option funcs were exec'd before logger init.
* `EnableHeadlessWithOpts()` attempted to create
browser instance & log warnings during the
config phase.
* `Logger` was only init'd later in `init()`
phase.
* This caused nil pointer dereference when
`MustDisableSandbox()` returned true (root on
Linux/Unix or Windows).
Changes:
* Init `Logger` in `types.DefaultOptions()` to
ensure it's always available before any option
functions execute.
* Init `Logger` field in both
`NewNucleiEngineCtx()` and
`NewThreadSafeNucleiEngineCtx()` from
`defaultOptions.Logger`.
* Move browser instance creation from
`EnableHeadlessWithOpts()` to the `init()` phase
where `Logger` is guaranteed to be available.
* Simplify logger sync logic in `init()` to only
update if changed by `WithLogger` option.
* Add test case to verify headless initialization
works without panic.
The fix maintains backward compatibility while
make sure the logger is always available when
needed by any SDK option function.
Fixes#6601.
Signed-off-by: Dwi Siswanto <[email protected]>
* build(make): adds `-timeout 30m -count 1` GOFLAGS in `test` cmd
Signed-off-by: Dwi Siswanto <[email protected]>
* Revert "fix(lib): segfault when init engine with `EnableHeadlessWithOpts`"
let see if this pass flaky test.
This reverts commit 63fcb6a1cbe7a4db7a78be766affc70eb237e57e.
* test(engine): let see if this pass flaky test
Signed-off-by: Dwi Siswanto <[email protected]>
* Revert "Revert "fix(lib): segfault when init engine with `EnableHeadlessWithOpts`""
This reverts commit 62b4223803ccb1e93593e2e08e39923d76aa20b1.
* test(engine): increase `TestActionNavigate` timeout
Signed-off-by: Dwi Siswanto <[email protected]>
* Revert "test(engine): let see if this pass flaky test"
This reverts commit d27cd985cff1b06aa1965ea11f8aa32f00778ab5.
---------
Signed-off-by: Dwi Siswanto <[email protected]>
* feat(loader): implement persistent metadata cache
for template filtering optimization.
Introduce a new template metadata indexing system
with persistent caching to dramatically improve
template loading perf when filters are applied.
The implementation adds a new index pkg that
caches lightweight template metadata (ID, tags,
authors, severity, .etc) and enables filtering
templates before expensive YAML parsing occurs.
The index uses an in-memory LRU cache backed by
`otter` pkg for efficient memory management with
adaptive sizing based on entry weight, defaulting
to approx. 40MB for 50K templates.
Metadata is persisted to disk using gob encoding
at "~/.cache/nuclei/index.gob" with atomic writes
to prevent corruption. The cache automatically
invalidates stale entries using `ModTime` to
detect file modifications, ensuring metadata
freshness w/o manual intervention.
Filtering has been refactored from the previous
`TagFilter` and `PathFilter` approach into a
unified `index.Filter` type that handles all basic
filtering ops including severity, authors, tags,
template IDs with wildcard support, protocol
types, and path-based inclusion and exclusion. The
filter implements OR logic within each field type
and AND logic across different field types, with
exclusion filters taking precedence over inclusion
filters and forced inclusion via
`IncludeTemplates` and `IncludeTags` overriding
exclusions.
The `loader` integration creates an index filter
from store configuration via `buildIndexFilter`
and manages the cache lifecycle through
`loadTemplatesIndex` and `saveTemplatesIndex`
methods. When `LoadTemplatesOnlyMetadata` or
`LoadTemplatesWithTags` is called, the system
first checks the metadata cache for each template
path. If cached metadata exists and passes
validation, the filter is applied directly against
the metadata without parsing. Only templates
matching the filter criteria proceed to full YAML
parsing, resulting in significant performance
gains.
Advanced filtering via "-tc" flag
(`IncludeConditions`) still requires template
parsing as these are expression-based filters that
cannot be evaluated from metadata alone. The
`TagFilter` has been simplified to handle only
`IncludeConditions` while all other filtering ops
are delegated to the index-based filtering system.
Cache management is fully automatic with no user
configuration required. The cache gracefully
handles errors by logging warnings & falling back
to normal op w/o caching. Cache files use schema
versioning to invalidate incompatible cache
formats across nuclei updates (well, specifically
`Index` and `Metadata` changes).
This optimization particularly benefits repeated
scans with the same filters, CI/CD pipelines
running nuclei regularly, development and testing
workflows with frequent template loading, and any
scenario with large template collections where
filtering would exclude most templates.
* test(loader): adds `BenchmarkLoadTemplates{,OnlyMetadata}` benchs
Signed-off-by: Dwi Siswanto <[email protected]>
* ci: cache nuclei-templates index
Signed-off-by: Dwi Siswanto <[email protected]>
* chore(index): satisfy lints
Signed-off-by: Dwi Siswanto <[email protected]>
* fix(index): correct metadata filter logic
for proper template matching.
The `filter.matchesIncludes()` was using OR logic
across different filter types, causing incorrect
template matching. Additionally, ID matching was
case-sensitive, failing to match patterns like
'CVE-2021-*'.
The filter now correctly implements: (author1 OR
author2) AND (tag1 OR tag2) AND (severity1 OR
severity2) - using OR within each filter type and
AND across different types.
Signed-off-by: Dwi Siswanto <[email protected]>
* test(index): resolve test timing issue
in CI environments.
Some test was failing in CI due to filesystem
timestamp resolution limitations. On filesystems
with 1s ModTime granularity (common in CI),
modifying a file immediately after capturing its
timestamp resulted in identical ModTime values,
causing IsValid() to incorrectly return true.
Signed-off-by: Dwi Siswanto <[email protected]>
* ci: cache nuclei with composite action
Signed-off-by: Dwi Siswanto <[email protected]>
* fix(index): file locking issue on Windows
during cache save/load.
Explicitly close file handles before performing
rename/remove ops in `Save` and `Load` methods.
* In `Save`, close temp file before rename.
* In `Load`, close file before remove during error
handling/version mismatch.
Signed-off-by: Dwi Siswanto <[email protected]>
* test(index): flaky index tests on Windows
Fix path separator mismatch in `TestCacheSize`
and `TestCachePersistenceWithLargeDataset` by
using `filepath.Join` consistently instead of
hardcoded forward slashes.
Signed-off-by: Dwi Siswanto <[email protected]>
* test(cmd): init logger to prevent nil pointer deref
The integration tests were panicking with a nil
pointer dereference in `pkg/catalog/loader`
because the logger was not init'ed.
When `store.saveMetadataIndexOnce` attempted to
log the result of the metadata cache op, it
dereferenced the nil logger, causing a crash.
Signed-off-by: Dwi Siswanto <[email protected]>
* fix(loader): resolve include/exclude paths
for metadata cache filter.
The `indexFilter` was previously init'ed using raw
relative paths from the config for
`IncludeTemplates` and `ExcludeTemplates`.
But the persistent metadata cache stores templates
using their absolute paths. This mismatch caused
the `matchesPath` check to fail, leading to
templates being incorrectly excluded even when
explicitly included via flags
(e.g., "-include-templates
loader/excluded-template.yaml").
This commit updates `buildIndexFilter` to resolve
these paths to their absolute versions using
`store.config.Catalog.GetTemplatesPath` before
creating the filter, ensuring consistent path
matching against the metadata cache.
Signed-off-by: Dwi Siswanto <[email protected]>
* feat(index): adds `NewMetadataFromTemplate` func
Signed-off-by: Dwi Siswanto <[email protected]>
* refactor(index): return metadata when `(*Index).cache` is nil
Signed-off-by: Dwi Siswanto <[email protected]>
* refactor(loader): restore pre‑index behavior semantics
Signed-off-by: Dwi Siswanto <[email protected]>
---------
Signed-off-by: Dwi Siswanto <[email protected]>
* fix(interactsh): skip DNS lookups on interactsh domains
to prevent false positives.
Prevents nuclei from resolving interactsh domains
injected in Host headers, which would cause
self-interactions to be incorrectly reported as
matches.
Changes:
* Add `GetHostname()` method to `interactsh.Client`
to expose active server domain.
* Skip CNAME DNS lookups in
`(*http.Request).addCNameIfAvailable` when
hostname matches the
`(*interactsh.Client).GetHostname`.
Fixes#6613
Signed-off-by: Dwi Siswanto <[email protected]>
* fix(http): prevent false `interactshDomain` matches
Signed-off-by: Dwi Siswanto <[email protected]>
---------
Signed-off-by: Dwi Siswanto <[email protected]>
across multiple layers
Fixes timeout configuration conflicts where HTTP
requests would timeout prematurely despite
configured values in `@timeout` annotations or
`-timeout` flags.
RCA:
* `retryablehttp` pkg overriding with default
30s timeout.
* Custom timeouts not propagating to
`retryablehttp` layer.
* Multiple timeout layers not sync properly.
Changes:
* Propagate custom timeouts from `@timeout`
annotations to `retryablehttp` layer.
* Adjust 5-minute maximum cap to prevent DoS via
extremely large timeouts.
* Ensure `retryableHttpOptions.Timeout` respects
`ResponseHeaderTimeout`.
* Add comprehensive tests for timeout capping
behavior.
This allows templates to override global timeout
via `@timeout` annotations while preventing abuse
thru unreasonably large timeout values.
Fixes#6560.
Signed-off-by: Dwi Siswanto <[email protected]>
Fixes duplicate template storage & removes
unnecessary raw bytes caching.
Mem usage reduced by ~30%.
> 423MB => 299MB heap alloc.
* Use `StoreWithoutRaw()` to avoid storing raw
bytes.
* Remove duplicate storage in both caches.
* Remove ineffective raw bytes retrieval logic.
Benchmarks show 45% perf improvement with no
regressions.
Signed-off-by: Dwi Siswanto <[email protected]>
caused by shared context callbacks.
it was exposed after adding concurrent exec to
workflow processing and occurred when multiple
goroutines attempted to write to the same
`ctx.OnResult` callback field simultaneously,
causing data races during workflow template exec.
Signed-off-by: Dwi Siswanto <[email protected]>
add missing `go` keyword to anonymous funcs that
were intended to run as goroutines but were
executing synchronously instead.
Fixes#6492
Signed-off-by: Dwi Siswanto <[email protected]>
by:
* implement regex-based prompt matching for
password variants.
* add support for filling username prompts in
keyboard interactive challenges.
* improve debug logging with structured output.
this addresses issues with servers using
non-standard prompt formats and provides better
visibility into auth failures.
Signed-off-by: Dwi Siswanto <[email protected]>
* feat: Assume HTTP(S) server on high port is HTTP
* feat: enhance http probing tests
* improving issue description
---------
Co-authored-by: Matej Smycka <[email protected]>
Co-authored-by: Mzack9999 <[email protected]>
* fix(variable): global variable not same between two request in flow mode(#6337)
* update gitignore
---------
Co-authored-by: chuu <[email protected]>
Co-authored-by: PDTeamX <[email protected]>
Co-authored-by: Mzack9999 <[email protected]>
* normalize file `fpath` in `IsTemplate` using
filepath.FromSlash to ensure consistent matching
across platforms.
* update `GetKnownMiscDirectories` docs to clarify
that trailing slashes prevent false positives,
since `IsTemplate` compares against normalized
full paths.
Signed-off-by: Dwi Siswanto <[email protected]>
* jira: hotfix for Cloud to use /rest/api/3/search/jql in FindExistingIssue; add live test verifying v3 endpoint
* jira: fix Cloud v3 search response handling (no total); set Self from base
* fix lint error
* tests(jira): apply De Morgan to satisfy staticcheck QF1001
* Refactored header-based auth scans not to normalize the header names.
* Removed the header validation as it's not really useful here.
* adding docs
---------
Co-authored-by: Mzack9999 <[email protected]>
* Enhance matcher compilation with caching for regex and DSL expressions to improve performance. Update template parsing to conditionally retain raw templates based on size constraints.
* Implement caching for regex and DSL expressions in extractors and matchers to enhance performance. Introduce a buffer pool in raw requests to reduce memory allocations. Update template cache management for improved efficiency.
* feat: improve concurrency to be bound
* refactor: replace fmt.Sprintf with fmt.Fprintf for improved performance in header handling
* feat: add regex matching tests and benchmarks for performance evaluation
* feat: add prefix check in regex extraction to optimize matching process
* feat: implement regex caching mechanism to enhance performance in extractors and matchers, along with tests and benchmarks for validation
* feat: add unit tests for template execution in the core engine, enhancing test coverage and reliability
* feat: enhance error handling in template execution and improve regex caching logic for better performance
* Implement caching for regex and DSL expressions in the cache package, replacing previous sync.Map usage. Add unit tests for cache functionality, including eviction by capacity and retrieval of cached items. Update extractors and matchers to utilize the new cache system for improved performance and memory efficiency.
* Add tests for SetCapacities in cache package to ensure cache behavior on capacity changes
- Implemented TestSetCapacities_NoRebuildOnZero to verify that setting capacities to zero does not clear existing caches.
- Added TestSetCapacities_BeforeFirstUse to confirm that initial cache settings are respected and not overridden by subsequent capacity changes.
* Refactor matchers and update load test generator to use io package
- Removed maxRegexScanBytes constant from match.go.
- Replaced ioutil with io package in load_test.go for NopCloser usage.
- Restored TestValidate_AllowsInlineMultiline in load_test.go to ensure inline validation functionality.
* Add cancellation support in template execution and enhance test coverage
- Updated executeTemplateWithTargets to respect context cancellation.
- Introduced fakeTargetProvider and slowExecuter for testing.
- Added Test_executeTemplateWithTargets_RespectsCancellation to validate cancellation behavior during template execution.
* fix: handle jira deprecated endpoint
* refactor: update Jira issue search result structure to include 'Self' field
* Revert "refactor: update Jira issue search result structure to include 'Self' field"
This reverts commit b0953419d3.
* Revert "fix: handle jira deprecated endpoint"
This reverts commit 1fc05076cd.
* chore(deps): bump github.com/andygrunwald/go-jira to v1.16.1 and tidy
* fix(jira): migrate Issue.Search to SearchV2JQL with explicit Fields
* remove the stack trace when the nuclei-ignore file does not exist
* removing useless debug stack
---------
Co-authored-by: Mzack9999 <[email protected]>
* test(reporting/exporters/mongo): add mongo integration test with testcontainer-go module
Signed-off-by: Lorenzo Susini <[email protected]>
* execute exportes only on linux
---------
Signed-off-by: Lorenzo Susini <[email protected]>
Co-authored-by: Mzack9999 <[email protected]>
* fix: segfault in template caching logic
when templates had no executable requests after
option updates.
the cached templates could end up with 0 requests
and no flow execution path, resulting in a nil
engine pointer that was later derefer w/o
validation.
bug seq:
caching template (w/ valid requests) -> get cached
template -> `*ExecutorOptions.Options` copied and
modified (inconsistent) -> requests updated (with
new options -- some may be invalid, and without
recompile) -> template returned w/o validation ->
`compileProtocolRequests` -> `NewTemplateExecuter`
receive empty requests + empty flow = nil engine
-> `*TemplateExecuter.{Compile,Execute}` invoked
on nil engine = panic.
RCA:
1. `*ExecutorOptions.ApplyNewEngineOptions`
overwriting many fields.
2. copy op pointless; create a copy of options and
then immediately replace it with original
pointer.
3. missing executable requests validation after
cached templates is reconstructed with updated
options.
Thus, this affected `--automatic-scan` mode where
tech detection templates often have conditional
requests that may be filtered based on runtime
options.
Fixes#6417
Signed-off-by: Dwi Siswanto <[email protected]>
* fix(templates): recompile workflow with `tplCopy.Options`
Signed-off-by: Dwi Siswanto <[email protected]>
* fix(templates): strengthen cache hit guard
Signed-off-by: Dwi Siswanto <[email protected]>
* fix(protocols): skips template-specific fields
Signed-off-by: Dwi Siswanto <[email protected]>
---------
Signed-off-by: Dwi Siswanto <[email protected]>
* fix: remove undefined errorutil.ShowStackTrace
* feat: add make lint support and integrate with test
* refactor: migrate errorutil to errkit across codebase
- Replace deprecated errorutil with modern errkit
- Convert error declarations from var to func for better compatibility
- Fix all SA1019 deprecation warnings
- Maintain error chain support and stack traces
* fix: improve DNS test reliability using Google DNS
- Configure test to use Google DNS (8.8.8.8) for stability
- Fix nil pointer issue in DNS client initialization
- Keep production defaults unchanged
* fixing logic
* removing unwanted branches in makefile
---------
Co-authored-by: Mzack9999 <[email protected]>
* test(installer): adds `TestIsOutdatedVersionFix`
Signed-off-by: Dwi Siswanto <[email protected]>
* fix: prevent unnecessary template updates
when version API fails.
* fix `catalog/config.IsOutdatedVersion` logic for
empty version strings
* add GitHub API fallback when PDTM API is unavail
* only show outdated msg for actual version
mismatches
Signed-off-by: Dwi Siswanto <[email protected]>
---------
Signed-off-by: Dwi Siswanto <[email protected]>
- Add nil checks for detector and regexCache in DetectWAF()
- Add nil check for individual regex entries before MatchString()
- Add comprehensive unit tests for nil pointer scenarios
- Prevents runtime panic when WAF detector encounters nil pointers during regex matching
* bugfix: fix memory blowup using previousEvent for multi-proto execution
* refactor(tmplexec): uses supported protocol types
Signed-off-by: Dwi Siswanto <[email protected]>
* add co-author
Co-authored-by: Nakul Bharti <[email protected]>
Signed-off-by: Dwi Siswanto <[email protected]>
* refactor(tmplexec): mv builder inside loop scope
Signed-off-by: Dwi Siswanto <[email protected]>
* refactor(tmplexec): skip existing keys in `FillPreviousEvent`
The `FillPreviousEvent` func was modified to
prevent overwriting/duplicating entries in the
previous map.
It now checks if a key `k` from
`event.InternalEvent` already exists in the
previous map. If it does, the key is skipped. This
ensures that if `k` was already set (potentially
w/o a prefix), it's not re-added with an `ID_`
prefix.
Additionally, keys in `event.InternalEvent` that
already start with the current `ID_` prefix are
also skipped to avoid redundant prefixing.
This change simplifies the logic by removing the
`reqTypeWithIndexRegex` and directly addresses the
potential for duplicate / incorrectly prefixed
keys when `event.InternalEvent` grows during
protocol request execution.
Signed-off-by: Dwi Siswanto <[email protected]>
* chore(tmplexec): naming convention, `ID` => `protoID`
Signed-off-by: Dwi Siswanto <[email protected]>
* chore(tmplexec): it's request ID lol sorry
Signed-off-by: Dwi Siswanto <[email protected]>
---------
Signed-off-by: Dwi Siswanto <[email protected]>
Co-authored-by: Ice3man <[email protected]>
Co-authored-by: Nakul Bharti <[email protected]>
* fix(authx): JSON unmarshalling for Dynamic auth type
Correcting the `UnmarshalJSON` method to properly
unmarshal JSON, particularlyaddressing the
population of the embedded `Secret` field. This
was achieved by using a type alias to avoid
recursive calls and rely on default unmarshalling
behavior.
Signed-off-by: Dwi Siswanto <[email protected]>
* feat(authx): adds nil Dynamic struct check
Signed-off-by: Dwi Siswanto <[email protected]>
---------
Signed-off-by: Dwi Siswanto <[email protected]>
* Use proxy for dns and ssl templates
- while using template execute level function we need to override custom dialer
* rename overridedialer to customdialer
* Add proxy into hash
- proxy client is shared between non proxy requests
* add dialer into request object
- use request.dialer instead of global variable
* resolve comments
* rename dialer
latest version of nuclei requires 1.23.
2.023 go: github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest: github.com/projectdiscovery/nuclei/[email protected] requires go >= 1.23.0 (running go 1.22.2; GOTOOLCHAIN=local)
Fixes#6221
Instead of enumerating all chrome processes to determine
which ones need to be killed on shutdown, use the launcher.Kill()
method to terminate the process that was launched for this
browser instance.
* feat: fixed max-host-error blocking wrong port for template with error
* feat: log total results with time taken at end of execution
* bugfix: skip non-executed requests with progress in flow protocol
* feat: fixed request calculation in http protocol for progress
* misc adjustments
---------
Co-authored-by: Ice3man <[email protected]>
* Fix incorrect usage of os.MkdirTemp pattern
- Replaced the incorrect pattern "nuclei-nvd-%s" with a correct one "nuclei-nvd" in the os.MkdirTemp function call.
NOTE: The incorrect usage of %s in os.MkdirTemp caused it to be ignored, leading to potential issues with naming conventions for temporary directories and confusion in directory structure. The original function attempted to use string interpolation in a context where Go doesn't support it in os.MkdirTemp, which could result in unexpected behavior or errors when the directory name is processed.
* Removed redundant redefinition of defaultOpts in init()
- Redefining defaultOpts inside init() could lead to confusion, as it hides the global variable, causing the changes to be applied only within the init() scope and potentially causing unexpected behavior in other parts of the program.
* Refactor docgen: improve error handling and file operations
Moved the argument check to the start of main() so we don’t do any unnecessary work if the arguments aren’t provided. Also added proper error handling for encoder.Encode(jsonschemaData), since it was failing silently before.
Switched os.WriteFile to os.Create for better file handling and error reporting. To clean things up, I added a writeToFile() function to remove duplicate code.
For replacing schema paths, I used ReplaceAllString() instead of looping through matches—it’s cleaner and a bit more efficient. Also renamed r to t in the Namer function to make things clearer.
* Fix a Lint error
- Remove importing string
- add ability to override setDialer function for tcp
- socks proxy is not used incase of tcp protocol
- TCP uses global tcp dialer shared, we need template request level ability to set dialer
* Add ai flag
* Add AI flag 2
* fix stdin
* fix stdin 2
* minor
* print both url and path
* store ai generated templates in `$HOME/nuclei-templates/pdcp`
* todo
* do not remove all
* make it less restrictive
* use retryablehttp
* fix creds check
* return errs
* return more detailed err for non-ok status code
* add prompt validation
* fix integration tests
---------
Co-authored-by: Doğan Can Bakır <[email protected]>
This introduces a "nucleitcp" protocol that Nuclei will use when
making MySQL connections as part of its templates.
Previously, this would register (and de-register!) a custom "tcp"
dialer, and that applied globally, so any piece of software that
used a MySQL database and included nuclei in SDK mode would have
its database connections ripped out from under it due to the dialer
hijacking.
By using "nucleitcp" as the protocol, we are free to do whatever
we want with the dialer and not impact any other packages.
Within our `BuildDSN` function, we quietly replace the protocol to
"nucleitcp" if it was "tcp", so nuclei developers don't have to do
anything special to use this functionality; it will always do it.
* Move proxy variable from global to options
- Provides ability to pass diff proxy in single nuclei instance using sdk
* add type check (resolve comments)
Steps to reproduce the behavior, for example, commands to run Nuclei.
💡 Prefer copying text output over using screenshots for easier troubleshooting.
📝 For a more detailed output that could help in troubleshooting, you may want to run Nuclei with the **`-verbose`** or **`-debug`** flags. This will provide additional insights into what's happening under the hood.<br>
📊 For performance or memory investigations, use **`-profile-mem`**, which generates `*.cpu`, `*.mem`, and `*.trace` files. Since GitHub doesn't support these formats directly, compress them (e.g., .zip or .tar.gz) and attach the archive under the "Anything else" section below.
:warning: **Please redact any literal target hosts/URLs or other sensitive information.**
placeholder:|
1. Run `nuclei -t ...`
@@ -44,16 +49,24 @@ body:
- type:textarea
attributes:
label:Relevant log output
description:Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
description:|
Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
💡 Prefer copying text output over using screenshots for easier troubleshooting.
📝 For a more detailed output that could help in troubleshooting, you may want to run Nuclei with the **`-verbose`** or **`-debug`** flags. This will provide additional insights into what's happening under the hood.<br>
📊 For performance or memory investigations, use **`-profile-mem`**, which generates `*.cpu`, `*.mem`, and `*.trace` files. Since GitHub doesn't support these formats directly, compress them (e.g., .zip or .tar.gz) and attach the archive under the "Anything else" section below.
:warning: **Please redact any literal target hosts/URLs or other sensitive information.**
render:shell
- type:textarea
attributes:
label:Environment
description:|
Examples:
- **OS**: Ubuntu 20.04
- **Nuclei** (`nuclei -version`): v3.3.1
- **Go** (`go version`): go1.22.0 _(only if you've installed it via the `go install` command)_
- **OS**: Ubuntu 24.04
- **Nuclei** (`nuclei -version`): v3.6.0
- **Go** (`go version`): go1.24.0 _(only if you've installed it via the `go install` command)_
value:|
- OS:
- Nuclei:
@@ -65,7 +78,7 @@ body:
attributes:
label:Anything else?
description:|
Links? References? Templates? Anything that will give us more context about the issue you are encountering!
Links? References? Templates? CPU, memory, and trace profiles? Anything that will give us more context about the issue you are encountering!
Tip: You can attach images or log files by clicking this area to highlight it and then dragging files in.
This folder contains the preserved issue templates that are **not** directly accessible to users. These templates serve as references for maintainers when converting discussions to issues.
<!-- Describe the overall picture of your modifications to help maintainers understand the pull request. PRs are required to be associated to their related issue tickets or feature request. -->
### Proof
<!-- How has this been tested? Please describe the tests that you ran to verify your changes. -->
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
## Project Overview
Nuclei is a modern, high-performance vulnerability scanner built in Go that leverages YAML-based templates for customizable vulnerability detection. It supports multiple protocols (HTTP, DNS, TCP, SSL, WebSocket, WHOIS, JavaScript, Code) and is designed for zero false positives through real-world condition simulation.
## Development Commands
### Building and Testing
-`make build` - Build the main nuclei binary to ./bin/nuclei
-`make test` - Run unit tests with race detection
-`make integration` - Run integration tests (builds and runs test suite)
-`make functional` - Run functional tests
-`make vet` - Run go vet for code analysis
-`make tidy` - Clean up go modules
### Validation and Linting
-`make template-validate` - Validate nuclei templates using the built binary
-`go fmt ./...` - Format Go code
-`go vet ./...` - Static analysis
### Development Tools
-`make devtools-all` - Build all development tools (bindgen, tsgen, scrapefuncs)
-`make jsupdate-all` - Update JavaScript bindings and TypeScript definitions
-`make docs` - Generate documentation
-`make memogen` - Generate memoization code for JavaScript libraries
### Testing Specific Components
- Run single test: `go test -v ./pkg/path/to/package -run TestName`
- Integration tests are in `integration_tests/` and can be run via `make integration`
## Architecture Overview
### Core Components
- **cmd/nuclei** - Main CLI entry point with flag parsing and configuration
- **internal/runner** - Core runner that orchestrates the entire scanning process
- **pkg/core** - Execution engine with work pools and template clustering
- **pkg/templates** - Template parsing, compilation, and management
@@ -22,7 +22,7 @@ When this flag is provided, nuclei will print the list of all helper functions a
-`-svd` flag
When this flag is provided, nuclei will print all `variables` pre and postexecution of a request for a template. This is useful to understand what variables are available for a template and what values they have.
When this flag is provided, nuclei will print all `variables` pre- and post-execution of a request for a template. This is useful to understand what variables are available for a template and what values they have.
-`-elog = errors.txt` flag
@@ -40,6 +40,8 @@ Nuclei was built with some environment variables in mind to help with debugging.
| `SHOW_DSL_ERRORS=true` | Enables Printing DSL Errors (that are hidden by default) |
LABEL org.opencontainers.image.description="Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations."
Nuclei is a modern, high-performance vulnerability scanner that leverages simple YAML-based templates. It empowers you to design custom vulnerability detection scenarios that mimic real-world conditions, leading to zero false positives.
<br>
**Nuclei is a modern, high-performance vulnerability scanner that leverages simple YAML-based templates. It empowers you to design custom vulnerability detection scenarios that mimic real-world conditions, leading to zero false positives.**
- Simple YAML format for creating and customizing vulnerability templates.
- Contributed by thousands of security professionals to tackle trending vulnerabilities.
- Reduce false positives by simulating real-world steps to verify a vulnerability.
- Ultra-fast parallel scan processing and request clustering.
- Integrate into CI/CD pipelines for vulnerability detection and regression testing.
- Supports multiple protocols like TCP, DNS, HTTP, SSL, WHOIS JavaScript, Code and more.
- Supports multiple protocols like TCP, DNS, HTTP, SSL, WHOIS, JavaScript, Code and more.
- Integrate with Jira, Splunk, GitHub, Elastic, GitLab.
<br>
<br>
## Table of Contents
- [Get Started](#get-started)
- [1. Nuclei CLI](#1-nuclei-cli)
- [2. Pro and Enterprise Editions](#2-pro-and-enterprise-editions)
- [_`Scanning with your custom template`_](#scanning-with-your-custom-template)
- [_`Connect Nuclei to ProjectDiscovery_`_](#connect-nuclei-to-projectdiscovery)
- [**`Nuclei Templates, Community and Rewards`**](#nuclei-templates-community-and-rewards-) 💎
- [**`Our Mission`**](#our-mission)
- [**`Contributors`**](#contributors-heart) ❤
- [**`License`**](#license)
---
| :exclamation: **Disclaimer** |
|---------------------------------|
| **This project is in active development**. Expect breaking changes with releases. Review the release changelog before updating. |
| This project is primarily built to be used as a standalone CLI tool. **Running nuclei as a service may pose security risks.** It's recommended to use with caution and additional security measures. |
<br>
<br>
## Get Started
### **1. Nuclei CLI**
Install Nuclei on your machine. Get started by following the installation guide [here](https://docs.projectdiscovery.io/tools/nuclei/install?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme). Additionally, We provide [a free cloud tier](https://cloud.projectdiscovery.io/sign-up) and comes with a generous monthly free limits:
_Install Nuclei on your machine. Get started by following the installation guide [**`here`**](https://docs.projectdiscovery.io/tools/nuclei/install?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme). Additionally, We provide [**`a free cloud tier`**](https://cloud.projectdiscovery.io/sign-up) and comes with a generous monthly free limits:_
- Store and visualize your vulnerability findings
- Write and manage your nuclei templates
- Access latest nuclei templates
- Discover and store your targets
> [!Important]
> |**This project is in active development**. Expect breaking changes with releases. Review the release changelog before updating.|
> |:--------------------------------|
> | This project is primarily built to be used as a standalone CLI tool. **Running nuclei as a service may pose security risks.** It's recommended to use with caution and additional security measures. |
<br>
### **2. Pro and Enterprise Editions**
For security teams and enterprises, we provide a cloud-hosted service built on top of Nuclei OSS, fine-tuned to help you continuously run vulnerability scans at scale with your team and existing workflows:
_For security teams and enterprises, we provide a cloud-hosted service built on top of Nuclei OSS, fine-tuned to help you continuously run vulnerability scans at scale with your team and existing workflows:_
- Plus: Real-time scanning, SAML SSO, SOC 2 compliant platform (with EU and US hosting options), shared team workspaces, and more
- We're constantly [adding new features](https://feedback.projectdiscovery.io/changelog)!
- We're constantly [**`adding new features`**](https://feedback.projectdiscovery.io/changelog)!
- **Ideal for:** Pentesters, security teams, and enterprises
[**`Sign up to Pro`**](https://projectdiscovery.io/pricing?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme) or [**`Talk to our team`**](https://projectdiscovery.io/request-demo?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme) if you have large organization and complex requirements.
<br>
<br>
## Documentation
Browse the full Nuclei [documentation here](https://docs.projectdiscovery.io/tools/nuclei/running). If you’re new to Nuclei, check out our [foundational Youtube series.](https://www.youtube.com/playlist?list=PLZRbR9aMzTTpItEdeNSulo8bYsvil80Rl)
Browse the full Nuclei [**`documentation here`**](https://docs.projectdiscovery.io/tools/nuclei/running). If you’re new to Nuclei, check out our [**`foundational YouTube series`**](https://www.youtube.com/playlist?list=PLZRbR9aMzTTpItEdeNSulo8bYsvil80Rl).
Additional documentation is available at:https://docs.nuclei.sh/getting-started/running
```
Additional documentation is available at: [https://docs.nuclei.sh/getting-started/running](https://docs.nuclei.sh/getting-started/running?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme)
Additional documentation is available at: [**`docs.nuclei.sh/getting-started/running`**](https://docs.nuclei.sh/getting-started/running?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme)
> This feature is absolutely free and does not require any subscription. For a detailed guide, refer to the [documentation](https://docs.projectdiscovery.io/cloud/scanning/nuclei-scan?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme).
> This feature is absolutely free and does not require any subscription. For a detailed guide, refer to the [**`documentation`**](https://docs.projectdiscovery.io/cloud/scanning/nuclei-scan?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme).
<br>
<br>
## Nuclei Templates, Community and Rewards 💎
[Nuclei templates](https://github.com/projectdiscovery/nuclei-templates) are based on the concepts of YAML based template files that define how the requests will be sent and processed. This allows easy extensibility capabilities to nuclei. The templates are written in YAML which specifies a simple human-readable format to quickly define the execution process.
[**Nuclei templates**](https://github.com/projectdiscovery/nuclei-templates) are based on the concepts of YAML based template files that define how the requests will be sent and processed. This allows easy extensibility capabilities to nuclei. The templates are written in YAML which specifies a simple human-readable format to quickly define the execution process.
Try it online with our free AI powered Nuclei Templates Editor by [clicking here.](https://cloud.projectdiscovery.io/templates)
**Try it online with our free AI powered Nuclei Templates Editor by** [**`clicking here`**](https://cloud.projectdiscovery.io/templates).
Nuclei Templates offer a streamlined way to identify and communicate vulnerabilities, combining essential details like severity ratings and detection methods. This open-source, community-developed tool accelerates threat response and is widely recognized in the cybersecurity world. Nuclei templates are actively contributed by thousands of security researchers globally. We run two programs for our contributors: [Pioneers](https://projectdiscovery.io/pioneers) and [💎 bounties](https://github.com/projectdiscovery/nuclei-templates/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22%F0%9F%92%8E%20Bounty%22).
Nuclei Templates offer a streamlined way to identify and communicate vulnerabilities, combining essential details like severity ratings and detection methods. This open-source, community-developed tool accelerates threat response and is widely recognized in the cybersecurity world. Nuclei templates are actively contributed by thousands of security researchers globally. We run two programs for our contributors: [**`Pioneers`**](https://projectdiscovery.io/pioneers) and [**`💎 bounties`**](https://github.com/projectdiscovery/nuclei-templates/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22%F0%9F%92%8E%20Bounty%22).
<p align="left">
@@ -403,7 +442,7 @@ Nuclei Templates offer a streamlined way to identify and communicate vulnerabili
#### Examples
Visit [our documentation](https://docs.projectdiscovery.io/templates/introduction) for use cases and ideas.
Visit [**our documentation**](https://docs.projectdiscovery.io/templates/introduction) for use cases and ideas.
Traditional vulnerability scanners were built decades ago. They are closed-source, incredibly slow, and vendor-driven. Today's attackers are mass exploiting newly released CVEs across the internet within days, unlike the years it used to take. This shift requires a completely different approach to tackling trending exploits on the internet.
We built Nuclei to solve this challenge. We made the entire scanning engine framework open and customizable—allowing the global security community to collaborate and tackle the trending attack vectors and vulnerabilities on the internet. Nuclei is now used and contributed by Fortune 500 enterprises, government agencies, universities.
You can participate by contributing to our code, [templates library](https://github.com/projectdiscovery/nuclei-templates), or [joining our team.](https://projectdiscovery.io/)
You can participate by contributing to our code, [**`templates library`**](https://github.com/projectdiscovery/nuclei-templates), or [**`joining our team`**](https://projectdiscovery.io/).
<br>
<br>
## Contributors :heart:
Thanks to all the amazing [community contributors for sending PRs](https://github.com/projectdiscovery/nuclei/graphs/contributors) and keeping this project updated. :heart:
Thanks to all the amazing [**`community contributors for sending PRs`**](https://github.com/projectdiscovery/nuclei/graphs/contributors) and keeping this project updated. :heart:
@@ -53,7 +54,7 @@ Kami memiliki [repositori khusus](https://github.com/projectdiscovery/nuclei-tem
# Instalasi Nuclei
Nuclei membutuhkan **go1.21** agar dapat diinstall. Jalankan perintah berikut untuk menginstal versi terbaru -
Nuclei membutuhkan **go1.24.2** agar dapat diinstall. Jalankan perintah berikut untuk menginstal versi terbaru -
```sh
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
@@ -97,7 +98,7 @@ Flags:
TARGET:
-u, -target string[] target URLs/hosts to scan
-l, -list string path to file containing a list of target URLs/hosts to scan (one per line)
-resume string resume scan using resume.cfg (clustering will be disabled)
-resume string resume scan from and save to specified file (clustering will be disabled)
-sa, -scan-all-ips scan all the IP's associated with dns record
-iv, -ip-version string[] IP version to scan of hostname (4,6) - (default 4)
@@ -210,6 +211,7 @@ RATE-LIMIT:
-c, -concurrency int maximum number of templates to be executed in parallel (default 25)
-hbs, -headless-bulk-size int maximum number of headless hosts to be analyzed in parallel per template (default 10)
-headc, -headless-concurrency int maximum number of headless templates to be executed in parallel (default 10)
-tlc, -template-loading-concurrency int maximum number of concurrent template loading operations (default 50)
OPTIMIZATIONS:
-timeout int time to wait in seconds before timeout (default 10)
@@ -340,7 +342,7 @@ Nuclei memungkinkan Anda untuk menyesuaikan pendekatan pengujian Anda dengan ran
- Dapat memproses ribuan host hanya dalam beberapa menit.
- Mudah mengotomatiskan pendekatan pengujian khusus Anda dengan sintaks DSL berbasis YAML sederhana kami.
Silakan periksa proyek sumber terbuka kami yang lain yang mungkin cocok dengan alur kerja celah berhadiah Anda: [github.com/projectdiscovery](http://github.com/projectdiscovery), kami juga menyediakan [penyegaran data DNS di Chaos setiap hari](http://chaos.projectdiscovery.io).
Silakan periksa proyek sumber terbuka kami yang lain yang mungkin cocok dengan alur kerja celah berhadiah Anda: [github.com/projectdiscovery](https://github.com/projectdiscovery), kami juga menyediakan [penyegaran data DNS di Chaos setiap hari](https://chaos.projectdiscovery.io).
@@ -51,7 +52,7 @@ Nuclei는 템플릿을 기반으로 대상 간에 요청을 보내기 위해 사
# 설치
Nuclei를 성공적으로 설치하기 위해서 **go1.21**가 필요합니다. 다음 명령을 실행하여 최신 버전을 설치합니다.
Nuclei를 성공적으로 설치하기 위해서 **go1.24.2**가 필요합니다. 다음 명령을 실행하여 최신 버전을 설치합니다.
```sh
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
@@ -95,7 +96,7 @@ Nuclei는 빠르고, 템플릿 기반의 취약점 스캐너로
TARGET:
-u, -target string[] 스캔할 대상 URL/호스트
-l, -list string 스캔할 대상 URL/호스트 목록이 있는 파일 경로 (한 줄에 하나씩)
-resume string resume.cfg를 사용하여 스캔 재개 (클러스터링은 비활성화됨)
-resume string 지정된 파일에서 스캔을 재개하고 지정된 파일에 저장 (클러스터링은 비활성화됨)
-sa, -scan-all-ips dns 레코드와 관련된 모든 IP 스캔
-iv, -ip-version string[] 스캔할 호스트의 IP 버전 (4,6) - (기본값 4)
@@ -208,6 +209,7 @@ RATE-LIMIT:
-c, -concurrency int 병렬로 실행할 최대 템플릿 수 (기본값 25)
-hbs, -headless-bulk-size int 템플릿당 병렬로 분석할 최대 headless 호스트 수 (기본값 10)
-headc, -headless-concurrency int 병렬로 실행할 최대 headless 템플릿 수 (기본값 10)
-tlc, -template-loading-concurrency int 최대 동시 템플릿 로딩 작업 수 (기본값 50)
OPTIMIZATIONS:
-timeout int 타임아웃 전에 기다릴 초 수 (기본값 10)
@@ -340,7 +342,7 @@ Nuclei를 사용하면 자체 검사 모음으로 테스트 접근 방식을 사
- 몇 분 안에 수천 개의 호스트를 처리할 수 있음.
- 간단한 YAML DSL로 사용자 지정 테스트 접근 방식을 쉽게 자동화할 수 있음.
버그 바운티 워크플로에 맞는 다른 오픈 소스 프로젝트를 확인할 수 있습니다.: [github.com/projectdiscovery](http://github.com/projectdiscovery), 또한, 우리는 매일 [Chaos에서 DNS 데이터를 갱신해 호스팅합니다.](http://chaos.projectdiscovery.io).
버그 바운티 워크플로에 맞는 다른 오픈 소스 프로젝트를 확인할 수 있습니다.: [github.com/projectdiscovery](https://github.com/projectdiscovery), 또한, 우리는 매일 [Chaos에서 DNS 데이터를 갱신해 호스팅합니다](https://chaos.projectdiscovery.io).
O Nuclei é utilizado para enviar solicitações para vários alvos baseados em um modelo, resultando em zero falsos positivos e proporcionando uma varredura rápida em um grande número de hosts. O Nuclei oferece suporte a uma variedade de protocolos, incluindo TCP, DNS, HTTP, SSL, Arquivo, Whois, Websocket, Headless, Código, entre outros. Com modelos poderosos e flexíveis, o Nuclei pode ser usado para modelar todos os tipos de verificações de segurança.
Temos um [repositório dedicado](https://github.com/projectdiscovery/nuclei-templates) que abriga vários tipos de modelos de vulnerabilidades, contribuídos por **mais de 300** pesquisadores e engenheiros de segurança.
| **Este projeto está em desenvolvimento ativo**. Alterações significativas são esperadas em versões futuras. Consulte o changelog antes de atualizar. |
| Este projeto foi desenvolvido principalmente para ser usado como uma ferramenta CLI independente. **Executar o Nuclei como um serviço pode implicar riscos de segurança.** É recomendável utilizá-lo com precaução e medidas de segurança adicionais. |
# Instalação do Nuclei
O Nuclei requer **go1.24.2** para ser instalado corretamente. Execute o seguinte comando para instalar a versão mais recente:
```sh
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
```
<details>
<summary>Brew</summary>
```sh
brew install nuclei
```
</details>
<details>
<summary>Docker</summary>
```sh
docker pull projectdiscovery/nuclei:latest
```
</details>
**Mais métodos de instalação [podem ser encontrados aqui](https://docs.projectdiscovery.io/tools/nuclei/install).**
<table>
<tr>
<td>
### Modelos do Nuclei
O Nuclei possui suporte integrado para download/atualização automática de modelos a partir da versão [v2.5.2](https://github.com/projectdiscovery/nuclei/releases/tag/v2.5.2). O projeto [**Nuclei-Templates**](https://github.com/projectdiscovery/nuclei-templates) fornece uma lista de modelos prontos para uso, atualizados constantemente pela comunidade.
Você também pode usar a flag `update-templates` para atualizar os modelos do Nuclei a qualquer momento; também pode criar seus próprios testes para seu fluxo de trabalho e necessidades específicas seguindo o [guia de modelos](https://docs.projectdiscovery.io/templates/) do Nuclei.
A referência de sintaxe YAML DSL está disponível [aqui](SYNTAX-REFERENCE.md).
</td>
</tr>
</table>
### Uso
```sh
nuclei -h
```
Isso mostrará ajuda sobre a ferramenta. Aqui estão todas as opções que ela suporta.
```console
Nuclei é um scanner de vulnerabilidades rápido e baseado em templates
que se concentra em sua ampla configurabilidade, extensibilidade e facilidade de uso.
Usage:
./nuclei [flags]
Flags:
TARGET:
-u, -target string[] URLs/hosts a serem escaneados
-l, -list string caminho do arquivo contendo a lista de URLs/hosts a serem escaneados (um por linha)
-eh, -exclude-hosts string[] hosts a serem excluídos do escaneamento na lista de entrada (ip, cidr, hostname)
-resume string retomar o escaneamento a partir de e salvar no arquivo especificado (a clusterização será desabilitada)
-sa, -scan-all-ips escanear todos os IPs associados ao registro DNS
-iv, -ip-version string[] versão de IP a escanear do nome do host (4,6) - (padrão 4)
TARGET-FORMAT:
-im, -input-mode string modo do arquivo de entrada (list, burp, jsonl, yaml, openapi, swagger) (padrão "list")
-ro, -required-only usar apenas campos obrigatórios no formato de entrada ao gerar requisições
-sfv, -skip-format-validation pular a validação de formato (como variáveis ausentes) ao processar o arquivo de entrada
TEMPLATES:
-nt, -new-templates executar apenas os novos templates adicionados na última versão de nuclei-templates
-ntv, -new-templates-version string[] executar os novos templates adicionados na versão especificada
-as, -automatic-scan escaneamento da web automático utilizando a detecção de tecnologia do Wappalyzer para mapeamento de tags
-t, -templates string[] lista de templates ou diretório de templates a executar (separados por vírgulas, arquivo)
-turl, -template-url string[] URL de template ou lista contendo URLs de templates a executar (separados por vírgulas, arquivo)
-w, -workflows string[] lista de fluxos de trabalho ou diretório de fluxos de trabalho a executar (separados por vírgulas, arquivo)
-wurl, -workflow-url string[] URL de fluxo de trabalho ou lista contendo URLs de fluxos de trabalho para executar (separados por vírgulas, arquivo)
-validate valida os templates passados para o nuclei
-nss, -no-strict-syntax desativa a verificação de sintaxe estrita nos templates
-td, -template-display exibe o conteúdo dos templates
-tl lista todos os templates disponíveis
-tgl lista todas as tags disponíveis
-sign assina os templates com a chave privada definida na variável de ambiente NUCLEI_SIGNATURE_PRIVATE_KEY
-code habilita o carregamento de templates baseados em protocolos de código
-dut, -disable-unsigned-templates desativa a execução de templates não assinados ou com assinatura incompatível
FILTERING:
-a, -author string[] templates a serem executados com base nos autores (separados por vírgulas, arquivo)
-tags string[] templates a serem executados com base em tags (separados por vírgulas, arquivo)
-etags, -exclude-tags string[] templates a excluir com base em tags (separados por vírgulas, arquivo)
-itags, -include-tags string[] tags a executar mesmo que estejam excluídas por padrão ou configuração
-id, -template-id string[] templates a serem executados com base em IDs de template (separados por vírgulas, arquivo, permitem curingas)
-eid, -exclude-id string[] templates a excluir com base em IDs de template (separados por vírgulas, arquivo)
-it, -include-templates string[] caminho do arquivo de template ou diretório a executar mesmo que estejam excluídos por padrão ou configuração
-et, -exclude-templates string[] caminho do arquivo de template ou diretório a excluir (separados por vírgulas, arquivo)
-em, -exclude-matchers string[] matchers de template a excluir no resultado
-s, -severity value[] templates a executar com base na criticidade. Valores possíveis: info, baixo, médio, alto, crítico, desconhecido
-es, -exclude-severity value[] templates a excluir com base na criticidade. Valores possíveis: info, baixo, médio, alto, crítico, desconhecido
-pt, -type value[] templates a executar com base no tipo de protocolo. Valores possíveis: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript
-ept, -exclude-type value[] templates a excluir com base no tipo de protocolo. Valores possíveis: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript
-tc, -template-condition string[] templates a executar com base em condição de expressão
OUTPUT:
-o, -output string arquivo de saída para salvar as ocorrências/vulnerabilidades detectadas
-sresp, -store-resp armazenar todas as solicitações/respostas enviadas pelo nuclei no diretório de saída
-srd, -store-resp-dir string armazenar todas as solicitações/respostas enviadas pelo nuclei em um diretório personalizado (padrão "output")
-silent exibir apenas os resultados
-nc, -no-color desativar a coloração do conteúdo de saída (códigos de escape ANSI)
-j, -jsonl salvar a saída no formato JSONL(ines)
-irr, -include-rr -omit-raw incluir pares solicitação/resposta nas saídas JSON, JSONL e Markdown (apenas para achados) [OBSOLETO usar -omit-raw] (padrão true)
-or, -omit-raw omitir os pares solicitação/resposta nas saídas JSON, JSONL e Markdown (apenas para achados)
-ot, -omit-template omitir o template codificado na saída JSON, JSONL
-nm, -no-meta desativar a exibição de metadados dos resultados na saída CLI
-ts, -timestamp ativar a exibição do carimbo de data/hora na saída CLI
-rdb, -report-db string banco de dados de relatórios do nuclei (usar sempre para persistir os dados dos relatórios)
-ms, -matcher-status exibir o estado de falha de correspondência
-me, -markdown-export string diretório para exportar resultados no formato Markdown
-se, -sarif-export string arquivo para exportar resultados no formato SARIF
-je, -json-export string arquivo para exportar resultados no formato JSON
-jle, -jsonl-export string arquivo para exportar resultados no formato JSONL(ines)
CONFIGURATIONS:
-config string caminho do arquivo de configuração do nuclei
-fr, -follow-redirects ativar o acompanhamento de redirecionamentos para templates HTTP
-fhr, -follow-host-redirects seguir redirecionamentos no mesmo host
-mr, -max-redirects int número máximo de redirecionamentos a seguir para templates HTTP (padrão 10)
-dr, -disable-redirects desativar redirecionamentos para templates HTTP
-rc, -report-config string arquivo de configuração do módulo de relatórios do nuclei
-H, -header string[] cabeçalho/cookie personalizado a incluir em todas as solicitações HTTP no formato header:value (CLI, arquivo)
-V, -var value variáveis personalizadas no formato key=value
-r, -resolvers string arquivo contendo uma lista de resolvers para o nuclei
-sr, -system-resolvers usar resolução DNS do sistema como fallback em caso de erro
-dc, -disable-clustering desativar o agrupamento de solicitações
-passive ativar o modo de processamento passivo de respostas HTTP
-fh2, -force-http2 forçar conexões HTTP2 nas solicitações
-ev, -env-vars ativar o uso de variáveis de ambiente no template
-cc, -client-cert string arquivo de certificado de cliente (codificado em PEM) usado para autenticar-se contra os hosts escaneados
-ck, -client-key string arquivo de chave de cliente (codificado em PEM) usado para autenticar-se contra os hosts escaneados
-ca, -client-ca string arquivo de autoridade de certificação de cliente (codificado em PEM) usado para autenticar-se contra os hosts escaneados
-sml, -show-match-line exibir linhas de correspondência para templates de arquivo, funciona apenas com extratores
-ztls usar a biblioteca ztls com fallback automático para padrão no tls13 [OBSOLETO] fallback automático para ztls já está ativado por padrão
-sni string nome de host tls sni a ser usado (padrão: nome de domínio de entrada)
-dt, -dialer-timeout value tempo limite para solicitações de rede
-dka, -dialer-keep-alive value duração do keep-alive para solicitações de rede
-lfa, -allow-local-file-access permitir acesso a arquivos (payload) em qualquer lugar do sistema
-lna, -restrict-local-network-access bloquear conexões à rede local/privada
-i, -interface string interface de rede a ser usada para o escaneamento de rede
-at, -attack-type string tipo de combinações de payload a realizar (batteringram, pitchfork, clusterbomb)
-sip, -source-ip string endereço IP de origem a ser usado para o escaneamento de rede
-rsr, -response-size-read int tamanho máximo de resposta a ser lido em bytes (padrão 10485760)
-rss, -response-size-save int tamanho máximo de resposta a ser salvo em bytes (padrão 1048576)
-reset remove todos os arquivos de configuração e dados do nuclei (incluindo os nuclei-templates)
-tlsi, -tls-impersonate ativar randomização experimental do client hello (ja3) tls
INTERACTSH:
-iserver, -interactsh-server string URL do servidor interactsh para instância auto-hospedada (padrão: oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me)
-itoken, -interactsh-token string token de autenticação para o servidor interactsh auto-hospedado
-interactions-cache-size int número de solicitações a serem mantidas no cache de interações (padrão 5000)
-interactions-eviction int número de segundos a esperar antes de remover solicitações do cache (padrão 60)
-interactions-poll-duration int número de segundos a esperar antes de cada solicitação de polling de interações (padrão 5)
-interactions-cooldown-period int tempo adicional para o polling de interações antes de encerrar (padrão 5)
-ni, -no-interactsh desativar o servidor interactsh para testes OAST, excluir templates baseados em OAST
FUZZING:
-ft, -fuzzing-type string sobrescreve o tipo de fuzzing definido no template (replace, prefix, postfix, infix)
-fm, -fuzzing-mode string sobrescreve o modo de fuzzing definido no template (multiple, single)
-fuzz habilita o carregamento de templates de fuzzing (Obsoleto: usar -dast em vez disso)
-dast executa apenas templates DAST
UNCOVER:
-uc, -uncover ativa o motor uncover
-uq, -uncover-query string[] consulta de busca uncover
-ue, -uncover-engine string[] motor de busca uncover (shodan,censys,fofa,shodan-idb,quake,hunter,zoomeye,netlas,criminalip,publicwww,hunterhow) (padrão shodan)
-ul, -uncover-limit int resultados uncover a serem retornados (padrão 100)
-ur, -uncover-ratelimit int sobrescreve o limite de taxa dos motores com o limite de taxa do motor uncover (padrão 60 req/min)
RATE-LIMIT:
-rl, -rate-limit int número máximo de solicitações a serem enviadas por segundo (padrão 150)
-rlm, -rate-limit-minute int número máximo de solicitações a serem enviadas por minuto
-bs, -bulk-size int número máximo de hosts a serem analisados em paralelo por template (padrão 25)
-c, -concurrency int número máximo de templates a serem executados em paralelo (padrão 25)
-hbs, -headless-bulk-size int número máximo de hosts headless a serem analisados em paralelo por template (padrão 10)
-headc, -headless-concurrency int número máximo de templates headless a serem executados em paralelo (padrão 10)
-jsc, -js-concurrency int número máximo de ambientes de execução de JavaScript a serem executados em paralelo (padrão 120)
-pc, -payload-concurrency int concorrência máxima de payload para cada template (padrão 25)
-tlc, -template-loading-concurrency int número máximo de operações de carregamento de templates concorrentes (padrão 50)
OPTIMIZATIONS:
-timeout int tempo limite em segundos (padrão 10)
-retries int número de tentativas para solicitações com falha (padrão 1)
-ldp, -leave-default-ports manter as portas HTTP/HTTPS padrão (exemplo: host:80, host:443)
-mhe, -max-host-error int número máximo de erros para um host antes de ignorá-lo no scan (padrão 30)
-te, -track-error string[] adiciona o erro especificado à lista de rastreamento de erros máximos por host (standard, file)
-nmhe, -no-mhe desativa a exclusão de hosts do scan com base em erros
-project utiliza uma pasta de projeto para evitar enviar a mesma solicitação várias vezes
-project-path string define um caminho específico para o projeto (padrão "/tmp")
-spm, -stop-at-first-match interrompe o processamento de solicitações HTTP após a primeira correspondência (pode quebrar a lógica de templates/fluxos de trabalho)
-stream modo de transmissão - começa a trabalhar sem ordenar a entrada
-ss, -scan-strategy value estratégia a ser usada durante o scan (auto/host-spray/template-spray) (padrão auto)
-irt, -input-read-timeout value tempo limite para leitura da entrada (padrão 3m0s)
-nh, -no-httpx desativa a análise httpx para entradas que não sejam URLs
-no-stdin desativa o processamento de entrada padrão
HEADLESS:
-headless habilita templates que requerem suporte para navegadores sem interface gráfica (headless browser) (o usuário root no Linux desativará o sandbox)
-page-timeout int segundos para esperar cada página no modo headless (padrão 20)
-sb, -show-browser exibe o navegador na tela ao executar templates no modo headless
-ho, -headless-options string[] inicia o Chrome no modo headless com opções adicionais
-sc, -system-chrome utiliza o navegador Chrome instalado localmente em vez do instalado pelo nuclei
-lha, -list-headless-action lista ações disponíveis para o modo headless
DEBUG:
-debug exibe todas as solicitações e respostas
-dreq, -debug-req exibe todas as solicitações enviadas
-dresp, -debug-resp exibe todas as respostas recebidas
-p, -proxy string[] lista de proxies HTTP/SOCKS5 a serem usados (separados por vírgulas ou arquivo de entrada)
-pi, -proxy-internal proxy para todas as solicitações internas
-ldf, -list-dsl-function lista todas as assinaturas de funções DSL suportadas
-tlog, -trace-log string arquivo para gravar o log de rastreamento de solicitações enviadas
-elog, -error-log string arquivo para gravar o log de erros de solicitações enviadas
-version exibe a versão do nuclei
-hm, -hang-monitor ativa o monitoramento de travamentos do nuclei
-v, -verbose exibe saída detalhada
-profile-mem string arquivo opcional para despejo de memória do nuclei
-vv exibe os templates carregados para o scan
-svd, -show-var-dump exibe o dump de variáveis para depuração
-ep, -enable-pprof ativa o servidor de depuração pprof
-tv, -templates-version exibe a versão dos templates do nuclei (nuclei-templates) instalados
-hc, -health-check executa verificações de diagnóstico
UPDATE:
-up, -update atualiza o mecanismo do nuclei para a última versão lançada
-ut, -update-templates atualiza os nuclei-templates para a última versão lançada
-ud, -update-template-dir string diretório personalizado para instalar/atualizar os nuclei-templates
-duc, -disable-update-check desativa a verificação automática de atualizações do nuclei/templates
STATISTICS:
-stats exibe estatísticas sobre o scan em execução
-sj, -stats-json exibe estatísticas no formato JSONL(ines)
-si, -stats-interval int número de segundos a esperar entre as atualizações de estatísticas (padrão 5)
-mp, -metrics-port int porta para expor métricas do nuclei (padrão 9092)
CLOUD:
-auth configura a chave de API do cloud do ProjectDiscovery (pdcp)
-cup, -cloud-upload faz upload dos resultados do scan para o dashboard do pdcp
-sid, -scan-id string faz upload dos resultados do scan para o ID de scan fornecido
AUTHENTICATION:
-sf, -secret-file string[] caminho para o arquivo de configuração contendo os secrets para o scan autenticado do nuclei
-ps, -prefetch-secrets pré-carrega os secrets do arquivo de secrets
EXAMPLES:
Executar nuclei em um único host:
$ nuclei -target example.com
Executar nuclei com diretórios específicos de templates:
Consulte https://docs.projectdiscovery.io/tools/nuclei/running para obter detalhes sobre como executar o Nuclei.
### Uso de Nuclei com código Go
O guia completo sobre como usar o Nuclei como biblioteca/SDK está disponível em [godoc](https://pkg.go.dev/github.com/projectdiscovery/nuclei/v3/lib#section-readme).
### Recursos
Você pode acessar a documentação principal do Nuclei em https://docs.projectdiscovery.io/tools/nuclei/ e obter mais informações sobre o Nuclei na nuvem com a [ProjectDiscovery Cloud Platform](https://cloud.projectdiscovery.io).
Consulte https://docs.projectdiscovery.io/tools/nuclei/resources para acessaar mais recursos e vídeos sobre o Nuclei!
### Créditos
Obrigado a todos os incríveis [contribuidores da comunidade que enviaram em PRs](https://github.com/projectdiscovery/nuclei/graphs/contributors) e mantêm este projeto atualizado. :heart:
Se você tem uma ideia ou algum tipo de melhoria, sinta-se à vontade para contribuir e participar do projeto. Envie seu PR!
returnfmt.Errorf("incorrect number of results: %d (actual) vs %v (expected) \nResults:\n\t%s\n",len(results),expectedNumbers,strings.Join(results,"\n\t"))// nolint:all
gologger.Fatal().Msgf("Could not validate templates: %s\n",err)
options.Logger.Fatal().Msgf("Could not validate templates: %s\n",err)
}else{
gologger.Fatal().Msgf("Could not run nuclei: %s\n",err)
options.Logger.Fatal().Msgf("Could not run nuclei: %s\n",err)
}
}
nucleiRunner.Close()
// on successful execution remove the resume file in case it exists
iffileutil.FileExists(resumeFileName){
os.Remove(resumeFileName)
_=os.Remove(resumeFileName)
}
}
@@ -235,7 +258,7 @@ on extensive configurability, massive extensibility and ease of use.`)
flagSet.StringSliceVarP(&options.Targets,"target","u",nil,"target URLs/hosts to scan",goflags.CommaSeparatedStringSliceOptions),
flagSet.StringVarP(&options.TargetsFilePath,"list","l","","path to file containing a list of target URLs/hosts to scan (one per line)"),
flagSet.StringSliceVarP(&options.ExcludeTargets,"exclude-hosts","eh",nil,"hosts to exclude to scan from the input list (ip, cidr, hostname)",goflags.FileCommaSeparatedStringSliceOptions),
flagSet.StringVar(&options.Resume,"resume","","resume scan using resume.cfg (clustering will be disabled)"),
flagSet.StringVar(&options.Resume,"resume","","resume scan from and save to specified file (clustering will be disabled)"),
flagSet.BoolVarP(&options.ScanAllIPs,"scan-all-ips","sa",false,"scan all the IP's associated with dns record"),
flagSet.StringSliceVarP(&options.IPVersion,"ip-version","iv",nil,"IP version to scan of hostname (4,6) - (default 4)",goflags.CommaSeparatedStringSliceOptions),
)
@@ -244,6 +267,8 @@ on extensive configurability, massive extensibility and ease of use.`)
flagSet.StringVarP(&options.InputFileMode,"input-mode","im","list",fmt.Sprintf("mode of input file (%v)",provider.SupportedInputFormats())),
flagSet.BoolVarP(&options.FormatUseRequiredOnly,"required-only","ro",false,"use only required fields in input format when generating requests"),
flagSet.BoolVarP(&options.SkipFormatValidation,"skip-format-validation","sfv",false,"skip format validation (like missing vars) when parsing input file"),
flagSet.BoolVarP(&options.VarsTextTemplating,"vars-text-templating","vtt",false,"enable text templating for vars in input file (only for yaml input mode)"),
flagSet.StringSliceVarP(&options.VarsFilePaths,"var-file-paths","vfp",nil,"list of yaml file contained vars to inject into yaml input",goflags.CommaSeparatedStringSliceOptions),
)
flagSet.CreateGroup("templates","Templates",
@@ -252,12 +277,13 @@ on extensive configurability, massive extensibility and ease of use.`)
flagSet.BoolVarP(&options.AutomaticScan,"automatic-scan","as",false,"automatic web scan using wappalyzer technology detection to tags mapping"),
flagSet.StringSliceVarP(&options.Templates,"templates","t",nil,"list of template or template directory to run (comma-separated, file)",goflags.FileCommaSeparatedStringSliceOptions),
flagSet.StringSliceVarP(&options.TemplateURLs,"template-url","turl",nil,"template url or list containing template urls to run (comma-separated, file)",goflags.FileCommaSeparatedStringSliceOptions),
flagSet.StringVarP(&options.AITemplatePrompt,"prompt","ai","","generate and run template using ai prompt"),
flagSet.StringSliceVarP(&options.Workflows,"workflows","w",nil,"list of workflow or workflow directory to run (comma-separated, file)",goflags.FileCommaSeparatedStringSliceOptions),
flagSet.StringSliceVarP(&options.WorkflowURLs,"workflow-url","wurl",nil,"workflow url or list containing workflow urls to run (comma-separated, file)",goflags.FileCommaSeparatedStringSliceOptions),
flagSet.BoolVar(&options.Validate,"validate",false,"validate the passed templates to nuclei"),
flagSet.BoolVarP(&options.NoStrictSyntax,"no-strict-syntax","nss",false,"disable strict syntax check on templates"),
flagSet.BoolVarP(&options.TemplateDisplay,"template-display","td",false,"displays the templates content"),
flagSet.BoolVar(&options.TemplateList,"tl",false,"list all available templates"),
flagSet.BoolVar(&options.TemplateList,"tl",false,"list all templates matching current filters"),
flagSet.BoolVar(&options.TagList,"tgl",false,"list all available tags"),
flagSet.StringSliceVarConfigOnly(&options.RemoteTemplateDomainList,"remote-template-domain",[]string{"cloud.projectdiscovery.io"},"allowed domain list to load remote templates from"),
flagSet.BoolVar(&options.SignTemplates,"sign",false,"signs the templates with the private key defined in NUCLEI_SIGNATURE_PRIVATE_KEY env variable"),
@@ -357,9 +383,15 @@ on extensive configurability, massive extensibility and ease of use.`)
flagSet.StringVarP(&options.FuzzingMode,"fuzzing-mode","fm","","overrides fuzzing mode set in template (multiple, single)"),
flagSet.BoolVar(&fuzzFlag,"fuzz",false,"enable loading fuzzing templates (Deprecated: use -dast instead)"),
flagSet.BoolVar(&options.DAST,"dast",false,"enable / run dast (fuzz) nuclei templates"),
flagSet.BoolVarP(&options.DASTServer,"dast-server","dts",false,"enable dast server mode (live fuzzing)"),
flagSet.BoolVarP(&options.DASTReport,"dast-report","dtr",false,"write dast scan report to file"),
flagSet.StringVarP(&options.DASTServerToken,"dast-server-token","dtst","","dast server token (optional)"),
flagSet.StringVarP(&options.DASTServerAddress,"dast-server-address","dtsa","localhost:9055","dast server address"),
flagSet.BoolVarP(&options.DisplayFuzzPoints,"display-fuzz-points","dfp",false,"display fuzz points in the output for debugging"),
flagSet.IntVar(&options.FuzzParamFrequency,"fuzz-param-frequency",10,"frequency of uninteresting parameters for fuzzing before skipping"),
flagSet.StringSliceVarP(&options.Scope,"fuzz-scope","cs",nil,"in scope url regex to be followed by fuzzer",goflags.FileCommaSeparatedStringSliceOptions),
flagSet.StringSliceVarP(&options.OutOfScope,"fuzz-out-scope","cos",nil,"out of scope url regex to be excluded by fuzzer",goflags.FileCommaSeparatedStringSliceOptions),
)
flagSet.CreateGroup("uncover","Uncover",
@@ -382,6 +414,7 @@ on extensive configurability, massive extensibility and ease of use.`)
flagSet.IntVarP(&options.JsConcurrency,"js-concurrency","jsc",120,"maximum number of javascript runtimes to be executed in parallel"),
flagSet.IntVarP(&options.PayloadConcurrency,"payload-concurrency","pc",25,"max payload concurrency for each template"),
flagSet.IntVarP(&options.ProbeConcurrency,"probe-concurrency","prc",50,"http probe concurrency with httpx"),
flagSet.IntVarP(&options.TemplateLoadingConcurrency,"template-loading-concurrency","tlc",types.DefaultTemplateLoadingConcurrency,"maximum number of concurrent template loading operations"),
options.Logger.Fatal().Msg("To utilize the `-ai` flag, please configure your API key with the `-auth` flag or set the `PDCP_API_KEY` environment variable")
the keys stored here especially `ci-private-key.pem` and `ci.crt` are used in integration tests to test template signing and verfication functionality introduced in nuclei v3
the keys stored here especially `ci-private-key.pem` and `ci.crt` are used in integration tests to test template signing and verification functionality introduced in nuclei v3
Loaded 100 of 526 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Dwi Siswanto