Merge pull request #2130 from projectdiscovery/dev

v2.7.2 Release

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,15 @@
+blank_issues_enabled: false
+
+contact_links:
+
+  - name: Ask an question / advise on using nuclei
+    url: https://github.com/projectdiscovery/nuclei/discussions/categories/q-a
+    about: Ask a question or request support for using nuclei
+
+  - name: Share idea / feature to discuss for nuclei
+    url: https://github.com/projectdiscovery/nuclei/discussions/categories/ideas
+    about: Share idea / feature to discuss for nuclei
+
+  - name: Connect with PD Team (Discord)
+    url: https://discord.gg/projectdiscovery
+    about: Connect with PD Team for direct communication

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,14 +1,21 @@
 ---
 name: Feature request
-about: Suggest an idea for this project
-title: "[feature]"
-labels: ''
+about: Request feature to implement in this project
+title: ""
+labels: 'Type: Enhancement'
 assignees: ''
 
 ---
 
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+<!--
+1. Please make sure to provide a detailed description with all the relevant information that might be required to start working on this feature.
+2. In case you are not sure about your request or whether the particular feature is already supported or not, please start a discussion instead.
+3. GitHub Discussion: https://github.com/projectdiscovery/nuclei/discussions/categories/ideas
+4. Join our discord server at https://discord.gg/projectdiscovery to discuss the idea on the #nuclei channel.
+-->
 
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
+### Please describe your feature request:
+<!-- A clear and concise description of feature to implement -->
+
+### Describe the use case of this feature:
+<!-- A clear and concise description of the feature request's motivation and the use-cases in which it could be useful. -->

.github/ISSUE_TEMPLATE/issue-report.md

@@ -1,18 +1,36 @@
 ---
 name: Issue report
-about: Create a report to help us improve
-title: "[issue]"
-labels: ''
-assignees: ''
+about: Create a report to help us to improve the project
+labels: 'Type: Bug'
 
 ---
 
-**Describe the bug**
-A clear and concise description of what the bug is.
+<!-- 
+1. Please search to see if an issue already exists for the bug you encountered.
+2. For support requests, FAQs or "How to" questions, please use the GitHub Discussions section instead - https://github.com/projectdiscovery/nuclei/discussions or
+3. Join our discord server at https://discord.gg/projectdiscovery and post the question on the #nuclei channel.
+-->
 
-**Nuclei version**
-Please share the version of the nuclei you are running with `nuclei -version` 
+<!-- ISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION. -->
+
+### Nuclei version:
+<!-- You can find current version of nuclei with "nuclei -version" -->
+<!-- We only accept issues that are reproducible on the latest version of nuclei. -->
+<!-- You can find the latest version of project at https://github.com/projectdiscovery/nuclei/releases/ -->
+
+### Current Behavior:
+<!-- A concise description of what you're experiencing. -->
+
+### Expected Behavior:
+<!-- A concise description of what you expected to happen. -->
+
+### Steps To Reproduce:
+<!--
+Example: steps to reproduce the behavior:
+1. Run 'nuclei -t ... -u ..'
+2. See error...
+-->
 
 
-**Screenshot of the error or bug**
-please add the screenshot showing bug or issue you are facing.
+### Anything else:
+<!-- Links? References? Screenshots? Anything that will give us more context about the issue that you are encountering! -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,13 @@
+## Proposed changes
+
+<!-- Describe the overall picture of your modifications to help maintainers understand the pull request. PRs are required to be associated to their related issue tickets or feature request. -->
+
+
+## Checklist
+
+<!-- Put an "x" in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code. -->
+
+- [ ] Pull request is created against the [dev](https://github.com/projectdiscovery/nuclei/tree/dev) branch
+- [ ] All checks passed (lint, unit/integration/regression tests etc.) with my changes
+- [ ] I have added tests that prove my fix is effective or that my feature works
+- [ ] I have added necessary documentation (if appropriate)

.github/dependabot.yml

@@ -11,24 +11,33 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    target-branch: "dev"
     commit-message:
       prefix: "chore"
       include: "scope"
+    labels:
+      - "Type: Maintenance"
 
   # Maintain dependencies for go modules
   - package-ecosystem: "gomod"
-    directory: "/"
+    directory: "v2/"
     schedule:
-      interval: "weekly"
+      interval: "daily"
+    target-branch: "dev"
     commit-message:
       prefix: "chore"
       include: "scope"
+    labels:
+      - "Type: Maintenance"
 
   # Maintain dependencies for docker
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "weekly"
+    target-branch: "dev"
     commit-message:
       prefix: "chore"
       include: "scope"
+    labels:
+      - "Type: Maintenance"

.github/workflows/build-test.yml

@@ -0,0 +1,43 @@
+name: 🔨 Build Test
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Test Builds
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macOS-latest]
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.18
+
+      - name: Check out code
+        uses: actions/checkout@v3
+
+      - name: Build
+        run: go build .
+        working-directory: v2/cmd/nuclei/
+
+      - name: Test
+        run: go test ./...
+        working-directory: v2/
+
+      - name: Integration Tests
+        env:
+          GH_ACTION: true
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        run: |
+          chmod +x run.sh
+          bash run.sh ${{ matrix.os }}
+        working-directory: integration_tests/
+
+      # At the bottom for known issue on OSX - https://github.com/projectdiscovery/nuclei/issues/1309
+      - name: Race Condition Tests
+        run: go build -race .
+        working-directory: v2/cmd/nuclei/

.github/workflows/build.yaml

@@ -1,45 +0,0 @@
-name: Build
-on:
-  push:
-    branches:
-      - master
-  pull_request:
-
-jobs:
-  lint:
-    name: golangci-lint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-      - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v2
-        with:
-          # Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
-          version: v1.33
-          args: --timeout 5m
-          working-directory: v2/
-        
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Set up Go
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.15
-
-      - name: Check out code
-        uses: actions/checkout@v2
-
-      - name: Test
-        run: go test ./...
-        working-directory: v2/
-
-      - name: Integration Tests
-        run: bash run.sh
-        working-directory: integration_tests/
-
-      - name: Build
-        run: go build .
-        working-directory: v2/cmd/nuclei/

.github/workflows/changelog-indexer.yaml

@@ -0,0 +1,29 @@
+name: 📑 Template-DB Indexer
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+jobs:
+  index:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: 1.18
+
+      - name: Intalling Indexer
+        run: |
+          git config --global url."https://${{ secrets.ACCESS_TOKEN }}@github".insteadOf https://github
+          git clone https://github.com/projectdiscovery/nucleish-api.git
+          cd nucleish-api/cmd/generate-index/
+          go install
+
+      - name: Generate Index
+        env:
+          AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
+          AWS_SECRET_KEY: ${{ secrets.AWS_SECRET_KEY }}
+        run: |
+          generate-index -mode changelog

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,39 @@
+name: 🚨 CodeQL Analysis
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+    branches:
+      - dev
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'go' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2

.github/workflows/dockerhub-push.yml

@@ -1,19 +1,40 @@
-# dockerhub-push pushes docker build to dockerhub automatically
-# on the creation of a new release
-name: Publish to Dockerhub on creation of a new release
-on: 
-  release:
-    types: [published]
+name: 🌥 Docker Push
+
+on:
+  workflow_run:
+    workflows: ["🎉 Release Binary"]
+    types:
+      - completed
+  workflow_dispatch:
+
 jobs:
-  update:
+  docker:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@master
-    - name: Publish to Dockerhub Registry
-      #pre: echo ::save-state name=RELEASE_VERSION::$(echo ${GITHUB_REF:10})
-      uses: elgohr/Publish-Docker-Github-Action@master
-      with:
-        name: projectdiscovery/nuclei
-        username: ${{ secrets.DOCKER_USERNAME }}
-        password: ${{ secrets.DOCKER_PASSWORD }}
-        tags: "latest" #"latest,${{ env.STATE_RELEASE_VERSION }}"
+      - name: Git Checkout
+        uses: actions/checkout@v3
+
+      - name: Get Github tag
+        id: meta
+        run: |
+          echo "::set-output name=tag::$(curl --silent "https://api.github.com/repos/projectdiscovery/nuclei/releases/latest" | jq -r .tag_name)"
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v2 
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: projectdiscovery/nuclei:latest,projectdiscovery/nuclei:${{ steps.meta.outputs.tag }}

.github/workflows/functional-test.yml

@@ -0,0 +1,31 @@
+name: 🧪 Functional Test
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+
+jobs:  
+  functional:
+    name: Functional Test
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macOS-latest]
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.18
+
+      - name: Check out code
+        uses: actions/checkout@v3
+
+      - name: Functional Tests
+        env:
+          GH_ACTION: true
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        run: |
+          chmod +x run.sh
+          bash run.sh ${{ matrix.os }}
+        working-directory: v2/cmd/functional-test

.github/workflows/lint-test.yml

@@ -0,0 +1,24 @@
+name: 🙏🏻 Lint Test
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  lint:
+    name: Lint Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.18
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - name: Run golangci-lint
+        uses: golangci/[email protected]
+        with:
+          version: latest
+          args: --timeout 5m
+          working-directory: v2/

.github/workflows/publish-docs.yaml

@@ -0,0 +1,51 @@
+name: ⏰ Publish Docs
+
+on:
+  push:
+    branches:
+      - dev
+  workflow_dispatch:
+
+jobs:
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v3
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+ 
+      - name: "Set up Go"
+        uses: actions/setup-go@v3
+        with: 
+          go-version: 1.18
+
+      - name: Generate YAML Syntax Documentation
+        id: generate-docs
+        run: |
+          if ! which dstdocgen > /dev/null; then
+            echo -e "Command dstdocgen not found! Installing\c"
+            go install github.com/projectdiscovery/yamldoc-go/cmd/docgen/dstdocgen@main
+          fi
+          go generate pkg/templates/templates.go
+          go build -o "cmd/docgen/docgen" cmd/docgen/docgen.go 
+          ./cmd/docgen/docgen ../SYNTAX-REFERENCE.md ../nuclei-jsonschema.json
+          echo "::set-output name=changes::$(git status -s | wc -l)"
+        working-directory: v2
+
+      - name: Commit files
+        if: steps.generate-docs.outputs.changes > 0
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Action"
+          git add SYNTAX-REFERENCE.md nuclei-jsonschema.json
+          git commit -m "Auto Generate Syntax Docs + JSONSchema [$(date)] :robot:" -a
+
+      - name: Push changes
+        if: steps.generate-docs.outputs.changes > 0
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}

.github/workflows/release-binary.yml

@@ -0,0 +1,27 @@
+name: 🎉 Release Binary
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+jobs: 
+  release: 
+    runs-on: ubuntu-latest
+
+    steps: 
+      - uses: actions/checkout@v3
+        with: 
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v3
+        with: 
+          go-version: 1.18
+
+      - uses: goreleaser/goreleaser-action@v3
+        with: 
+          args: "release --rm-dist"
+          version: latest
+          workdir: v2/
+        env: 
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/release.yml

@@ -1,30 +0,0 @@
-name: Release
-on:
-  create:
-    tags:
-      - v*
-
-jobs: 
-  release: 
-    runs-on: ubuntu-latest
-    steps: 
-      - 
-        name: "Check out code"
-        uses: actions/checkout@v2
-        with: 
-          fetch-depth: 0
-      - 
-        name: "Set up Go"
-        uses: actions/setup-go@v2
-        with: 
-          go-version: 1.15
-      - 
-        env: 
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-        name: "Create release on GitHub"
-        uses: goreleaser/goreleaser-action@v2
-        with: 
-          args: "release --rm-dist"
-          version: latest
-          workdir: v2/
-        

.github/workflows/sonarcloud.yml

@@ -0,0 +1,40 @@
+name: 👮🏼‍♂️ Sonarcloud
+on:
+  push:
+    branches:
+      - master
+      - dev
+  pull_request:
+    types: [opened, synchronize, reopened]
+  workflow_dispatch:
+
+jobs:
+  sonarcloud:
+    name: SonarCloud
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+     
+      - name: "Set up Go"
+        uses: actions/setup-go@v3
+        with: 
+          go-version: 1.18
+      
+      - name: Run unit Tests
+        working-directory: v2/
+        run: |
+          go test -coverprofile=cov.out ./...
+
+      - name: Run Gosec Security Scanner
+        working-directory: v2/
+        run: |
+          go install github.com/securego/gosec/cmd/gosec@latest
+          gosec -no-fail -fmt=sonarqube -out report.json ./...
+     
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarcloud-github-action@master
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/template-validate.yml

@@ -0,0 +1,28 @@
+name: 🛠 Template Validate
+
+on: [ push, pull_request ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v3
+        with: 
+          go-version: 1.18
+
+      - name: Cache Go
+        id: cache-go
+        uses: actions/cache@v3
+        with:
+          path: /home/runner/go
+          key: ${{ runner.os }}-go
+
+      - name: Installing Nuclei
+#        if: steps.cache-go.outputs.cache-hit != 'true'
+        run: |
+          go install github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
+      - name: Template Validation
+        run: |
+          nuclei -validate
+          nuclei -validate -w ./workflows

.gitignore

@@ -1,6 +1,13 @@
-cmd/nuclei/nuclei*
-v2/cmd/nuclei/nuclei
 .idea
-integration_tests/integration-test
 integration_tests/nuclei
-v2/cmd/integration-test/integration-test
+integration_tests/integration-test
+v2/cmd/nuclei/main
+v2/cmd/nuclei/nuclei
+v2/cmd/integration-test/nuclei
+v2/cmd/functional-test/nuclei_dev
+v2/cmd/functional-test/nuclei_main
+v2/cmd/functional-test/functional-test
+v2/cmd/docgen/docgen
+v2/pkg/protocols/common/helpers/deserialization/testdata/Deserialize.class
+v2/pkg/protocols/common/helpers/deserialization/testdata/ValueObject.class
+v2/pkg/protocols/common/helpers/deserialization/testdata/ValueObject2.ser

.golangci.yml

@@ -1,115 +0,0 @@
-linters-settings:
-  dupl:
-    threshold: 100
-  exhaustive:
-    default-signifies-exhaustive: false
-  # funlen:
-  #   lines: 100
-  #   statements: 50
-  #goconst:
-  #  min-len: 2
-  #  min-occurrences: 2
-  gocritic:
-    enabled-tags:
-      - diagnostic
-      - experimental
-      - opinionated
-      - performance
-      - style
-    disabled-checks:
-      - dupImport # https://github.com/go-critic/go-critic/issues/845
-      - ifElseChain
-  # gocyclo:
-  #   min-complexity: 15
-  goimports:
-    local-prefixes: github.com/golangci/golangci-lint
-  golint:
-    min-confidence: 0
-  gomnd:
-    settings:
-      mnd:
-        # don't include the "operation" and "assign"
-        checks: argument,case,condition,return
-  govet:
-    check-shadowing: true
-    settings:
-      printf:
-        funcs:
-          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Infof
-          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Warnf
-          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Errorf
-          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Fatalf
-  # lll:
-  #   line-length: 140
-  maligned:
-    suggest-new: true
-  misspell:
-    locale: US
-  nolintlint:
-    allow-leading-space: true # don't require machine-readable nolint directives (i.e. with no leading space)
-    allow-unused: false # report any unused nolint directives
-    require-explanation: false # don't require an explanation for nolint directives
-    require-specific: false # don't require nolint directives to be specific about which linter is being skipped
-
-linters:
-  # please, do not use `enable-all`: it's deprecated and will be removed soon.
-  # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
-  disable-all: true
-  enable:
-    #- bodyclose
-    - deadcode
-    - dogsled
-    - errcheck
-    - exhaustive
-    - gochecknoinits
-    #- goconst
-    - gocritic
-    - gofmt
-    - goimports
-    - golint
-    #- gomnd
-    - goprintffuncname
-    - gosimple
-    - govet
-    - ineffassign
-    - interfacer
-    - maligned
-    - misspell
-    - nakedret
-    - noctx
-    - nolintlint
-    - rowserrcheck
-    - scopelint
-    - staticcheck
-    - structcheck
-    - stylecheck
-    - typecheck
-    - unconvert
-    - unparam
-    - unused
-    - varcheck
-    - whitespace
-
-  # don't enable:
-  # - depguard
-  # - asciicheck
-  # - funlen
-  # - gochecknoglobals
-  # - gocognit
-  # - gocyclo
-  # - godot
-  # - godox
-  # - goerr113
-  # - gosec
-  # - lll
-  # - nestif
-  # - prealloc
-  # - testpackage
-  # - wsl
-
-# golangci.com configuration
-# https://github.com/golangci/golangci/wiki/Configuration
-service:
-  golangci-lint-version: 1.33.x # use the fixed version to not introduce new linters unexpectedly
-  prepare:
-    - echo "here I can run custom commands, but no preparation needed for this repo"

.run/IntegrationTests.run.xml

@@ -0,0 +1,19 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="IntegrationTests" type="ShConfigurationType">
+    <option name="SCRIPT_TEXT" value="" />
+    <option name="INDEPENDENT_SCRIPT_PATH" value="true" />
+    <option name="SCRIPT_PATH" value="$PROJECT_DIR$/integration_tests/run.sh" />
+    <option name="SCRIPT_OPTIONS" value="" />
+    <option name="INDEPENDENT_SCRIPT_WORKING_DIRECTORY" value="true" />
+    <option name="SCRIPT_WORKING_DIRECTORY" value="$PROJECT_DIR$/integration_tests/" />
+    <option name="INDEPENDENT_INTERPRETER_PATH" value="true" />
+    <option name="INTERPRETER_PATH" value="/bin/zsh" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="EXECUTE_IN_TERMINAL" value="true" />
+    <option name="EXECUTE_SCRIPT_FILE" value="true" />
+    <envs>
+      <env name="DEBUG" value="true" />
+    </envs>
+    <method v="2" />
+  </configuration>
+</component>

.run/RegressionTests.run.xml

@@ -0,0 +1,19 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="RegressionTests" type="ShConfigurationType">
+    <option name="SCRIPT_TEXT" value="" />
+    <option name="INDEPENDENT_SCRIPT_PATH" value="true" />
+    <option name="SCRIPT_PATH" value="$PROJECT_DIR$/v2/cmd/functional-test/run.sh" />
+    <option name="SCRIPT_OPTIONS" value="" />
+    <option name="INDEPENDENT_SCRIPT_WORKING_DIRECTORY" value="true" />
+    <option name="SCRIPT_WORKING_DIRECTORY" value="$PROJECT_DIR$/v2/cmd/functional-test/" />
+    <option name="INDEPENDENT_INTERPRETER_PATH" value="true" />
+    <option name="INTERPRETER_PATH" value="/bin/zsh" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="EXECUTE_IN_TERMINAL" value="true" />
+    <option name="EXECUTE_SCRIPT_FILE" value="true" />
+    <envs>
+      <env name="DEBUG" value="true" />
+    </envs>
+    <method v="2" />
+  </configuration>
+</component>

.run/UnitTests.run.xml

@@ -0,0 +1,12 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="UnitTests" type="GoTestRunConfiguration" factoryName="Go Test">
+    <module name="nuclei" />
+    <working_directory value="$PROJECT_DIR$/v2" />
+    <go_parameters value="-i" />
+    <kind value="DIRECTORY" />
+    <directory value="$PROJECT_DIR$/v2/" />
+    <filePath value="$PROJECT_DIR$" />
+    <framework value="gotest" />
+    <method v="2" />
+  </configuration>
+</component>

DESIGN.md

@@ -0,0 +1,610 @@
+# Nuclei Architecture Document
+
+A brief overview of Nuclei Engine architecture. This document will be kept updated as the engine progresses.
+
+## pkg/templates
+
+### Template
+
+Template is the basic unit of input to the engine which describes the requests to be made, matching to be done, data to extract, etc.
+
+The template structure is described here. Template level attributes are defined here as well as convenience methods to validate, parse and compile templates creating executers. 
+
+Any attributes etc. required for the template, engine or requests to function are also set here.
+
+Workflows are also compiled, their templates are loaded and compiled as well. Any validations etc. on the paths provided are also done here.
+
+`Parse` function is the main entry point which returns a template for a `filePath` and `executorOptions`. It compiles all the requests for the templates, all the workflows, as well as any self-contained request etc. It also caches the templates in an in-memory cache.
+
+### Preprocessors
+
+Preprocessors are also applied here which can do things at template level. They get data of the template which they can alter at will on runtime. This is used in the engine to do random string generation.
+
+Custom processor can be used if they satisfy the following interface.
+
+```go
+type Preprocessor interface {
+	Process(data []byte) []byte
+}
+```
+
+## pkg/model
+
+Model package implements Information structure for Nuclei Templates. `Info` contains all major metadata information for the template. `Classification` structure can also be used to provide additional context to vulnerability data.
+
+It also specifies a `WorkflowLoader` interface that is used during workflow loading in template compilation stage.
+
+```go
+type WorkflowLoader interface {
+	GetTemplatePathsByTags(tags []string) []string
+	GetTemplatePaths(templatesList []string, noValidate bool) []string
+}
+```
+
+## pkg/protocols
+
+Protocols package implements all the request protocols supported by Nuclei. This includes http, dns, network, headless and file requests as of now. 
+
+### Request
+
+It exposes a `Request` interface that is implemented by all the request protocols supported.
+
+```go
+// Request is an interface implemented any protocol based request generator.
+type Request interface {
+	Compile(options *ExecuterOptions) error
+	Requests() int
+	GetID() string
+	Match(data map[string]interface{}, matcher *matchers.Matcher) (bool, []string)
+	Extract(data map[string]interface{}, matcher *extractors.Extractor) map[string]struct{}
+	ExecuteWithResults(input string, dynamicValues, previous output.InternalEvent, callback OutputEventCallback) error
+	MakeResultEventItem(wrapped *output.InternalWrappedEvent) *output.ResultEvent
+	MakeResultEvent(wrapped *output.InternalWrappedEvent) []*output.ResultEvent
+	GetCompiledOperators() []*operators.Operators
+}
+```
+
+Many of these methods are similar across protocols while some are very protocol specific. 
+
+A brief overview of the methods is provided below -
+
+- **Compile** - Compiles the request with provided options.
+- **Requests** - Returns total requests made.
+- **GetID** - Returns any ID for the request
+- **Match** - Used to perform matching for patterns using matchers
+- **Extract** - Used to perform extraction for patterns using extractors
+- **ExecuteWithResults** - Request execution function for input.
+- **MakeResultEventItem** - Creates a single result event for the intermediate `InternalWrappedEvent` output structure.
+- **MakeResultEvent** - Returns a slice of results based on an `InternalWrappedEvent` internal output event.
+- **GetCompiledOperators** - Returns the compiled operators for the request.
+
+`MakeDefaultResultEvent` function can be used as a default for `MakeResultEvent` function when no protocol-specific features need to be implemented for result generation. 
+
+For reference protocol requests implementations, one can look at the below packages  - 
+
+1. [pkg/protocols/http](./v2/pkg/protocols/http)
+2. [pkg/protocols/dns](./v2/pkg/protocols/dns)
+3. [pkg/protocols/network](./v2/pkg/protocols/network)
+
+### Executer
+
+All these different requests interfaces are converted to an Executer which is also an interface defined in `pkg/protocols` which is used during final execution of the template.
+
+```go
+// Executer is an interface implemented any protocol based request executer.
+type Executer interface {
+	Compile() error
+	Requests() int
+	Execute(input string) (bool, error)
+	ExecuteWithResults(input string, callback OutputEventCallback) error
+}
+```
+
+The `ExecuteWithResults` function accepts a callback, which gets provided with results during execution in form of `*output.InternalWrappedEvent` structure.
+
+The default executer is provided in `pkg/protocols/common/executer` . It takes a list of Requests and relevant `ExecuterOptions` and implements the Executer interface required for template execution. The executer during Template compilation process is created from this package and used as-is.
+
+A different executer is the Clustered Requests executer which implements the Nuclei Request clustering functionality in `pkg/templates`  We have a single HTTP  request in cases where multiple templates can be clustered and multiple operator lists to match/extract. The first HTTP request is executed while all the template matcher/extractor are evaluated separately.
+
+For Workflow execution, a separate RunWorkflow function is used which executes the workflow independently of the template execution.
+
+With this basic premise set, we can now start exploring the current runner implementation which will also walk us through the architecture of nuclei.
+
+## internal/runner
+
+### Template loading
+
+The first process after all CLI specific initialisation is the loading of template/workflow paths that the user wants to run. This is done by the packages described below.
+
+#### pkg/catalog
+
+This package is used to get paths using mixed syntax. It takes a template directory and performs resolving for template paths both from provided template and current user directory.
+
+The syntax is very versatile and can include filenames, glob patterns, directories, absolute paths, and relative-paths.
+
+
+
+Next step is the initialisation of the reporting modules which is handled in `pkg/reporting`.  
+
+#### pkg/reporting
+
+Reporting module contains exporters and trackers as well as a module for deduplication and a module for result formatting. 
+
+Exporters and Trackers are interfaces defined in pkg/reporting.
+
+```go
+// Tracker is an interface implemented by an issue tracker
+type Tracker interface {
+	CreateIssue(event *output.ResultEvent) error
+}
+
+// Exporter is an interface implemented by an issue exporter
+type Exporter interface {
+	Close() error
+	Export(event *output.ResultEvent) error
+}
+```
+
+Exporters include `Elasticsearch`, `markdown`, `sarif` . Trackers include `GitHub` , `Gitlab` and `Jira`.
+
+Each exporter and trackers implement their own configuration in YAML format and are very modular in nature, so adding new ones is easy.
+
+
+
+After reading all the inputs from various sources and initialisation other miscellaneous options, the next bit is the output writing which is done using `pkg/output` module.
+
+#### pkg/output
+
+Output package implements the output writing functionality for Nuclei.
+
+Output Writer implements the Writer interface which is called each time a result is found for nuclei.
+
+```go
+// Writer is an interface which writes output to somewhere for nuclei events.
+type Writer interface {
+	Close()
+	Colorizer() aurora.Aurora
+	Write(*ResultEvent) error
+	Request(templateID, url, requestType string, err error)
+}
+```
+
+ResultEvent structure is passed to the Nuclei Output Writer which contains the entire detail of a found result. Various intermediary types like `InternalWrappedEvent` and `InternalEvent` are used throughout nuclei protocols and matchers to describe results in various stages of execution.
+
+
+
+ Interactsh is also initialised if it is not explicitly disabled. 
+
+#### pkg/protocols/common/interactsh
+
+Interactsh module is used to provide automatic Out-of-Band vulnerability identification in Nuclei. 
+
+It uses two LRU caches, one for storing interactions for request URLs and one for storing requests for interaction URL. These both caches are used to correlated requests received to the Interactsh OOB server and Nuclei Instance. [Interactsh Client](https://github.com/projectdiscovery/interactsh/pkg/client) package does most of the heavy lifting of this module.
+
+Polling for interactions and server registration only starts when a template uses the interactsh module and is executed by nuclei. After that no registration is required for the entire run.
+
+
+
+### RunEnumeration
+
+Next we arrive in the `RunEnumeration` function of the runner.
+
+`HostErrorsCache` is initialised which is used throughout the run of Nuclei enumeration to keep track of errors per host and skip further requests if the errors are greater than the provided threshold. The functionality for the error tracking cache is defined in [hosterrorscache.go](https://github.com/projectdiscovery/nuclei/blob/master/v2/pkg/protocols/common/hosterrorscache/hosterrorscache.go) and is pretty simplistic in nature.
+
+Next the `WorkflowLoader` is initialised which used to load workflows. It exists in `v2/pkg/parsers/workflow_loader.go`
+
+The loader is initialised moving forward which is responsible for Using Catalog, Passed Tags, Filters, Paths, etc. to return compiled `Templates` and `Workflows`. 
+
+#### pkg/catalog/loader
+
+First the input passed by the user as paths is normalised to absolute paths which is done by the `pkg/catalog` module.  Next the path filter module is used to remove the excluded template/workflows paths.
+
+`pkg/parsers` module's `LoadTemplate`,`LoadWorkflow` functions are used to check if the templates pass the validation + are not excluded via tags/severity/etc. filters. If all checks are passed, then the template/workflow is parsed and returned in a compiled form by the `pkg/templates`'s `Parse` function.
+
+`Parse` function performs compilation of all the requests in a template + creates Executers from them returning a runnable Template/Workflow structure.
+
+Clustering module comes in next whose job is to cluster identical HTTP GET requests together (as a lot of the templates perform the same get requests many times, it's a good way to save many requests on large scans with lots of templates). 
+
+### pkg/operators
+
+Operators package implements all the matching and extracting logic of Nuclei. 
+
+```go
+// Operators contain the operators that can be applied on protocols
+type Operators struct {
+	Matchers []*matchers.Matcher
+	Extractors []*extractors.Extractor
+	MatchersCondition string
+}
+```
+
+A protocol only needs to embed the `operators.Operators` type shown above, and it can utilise all the matching/extracting functionality of nuclei.
+
+```go
+// MatchFunc performs matching operation for a matcher on model and returns true or false.
+type MatchFunc func(data map[string]interface{}, matcher *matchers.Matcher) (bool, []string)
+
+// ExtractFunc performs extracting operation for an extractor on model and returns true or false.
+type ExtractFunc func(data map[string]interface{}, matcher *extractors.Extractor) map[string]struct{}
+
+// Execute executes the operators on data and returns a result structure
+func (operators *Operators) Execute(data map[string]interface{}, match MatchFunc, extract ExtractFunc, isDebug bool) (*Result, bool) 
+```
+
+The core of this process is the Execute function which takes an input dictionary as well as a Match and Extract function and return a `Result` structure which is used later during nuclei execution to check for results.
+
+```go
+// Result is a result structure created from operators running on data.
+type Result struct {
+	Matched bool
+	Extracted bool
+	Matches map[string][]string
+	Extracts map[string][]string
+	OutputExtracts []string
+	DynamicValues map[string]interface{}
+	PayloadValues map[string]interface{}
+}
+```
+
+The internal logics for matching and extracting for things like words, regexes, jq, paths, etc. is specified in `pkg/operators/matchers`, `pkg/operators/extractors`. Those packages should be investigated for further look into the topic.
+
+
+### Template Execution
+
+`pkg/core` provides the engine mechanism which runs the templates/workflows on inputs. It exposes an `Execute` function which does the task of execution while also doing template clustering. The clustering can also be disabled optionally by the user.
+ 
+An example of using the core engine is provided below.
+
+```go
+engine := core.New(r.options)
+engine.SetExecuterOptions(executerOpts)
+results := engine.ExecuteWithOpts(finalTemplates, r.hmapInputProvider, true)
+```
+
+### Using Nuclei From Go Code
+
+An example of using Nuclei From Go Code to run templates on targets is provided below.
+
+```go
+package main
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"path"
+
+	"github.com/logrusorgru/aurora"
+	"go.uber.org/ratelimit"
+
+	"github.com/projectdiscovery/goflags"
+	"github.com/projectdiscovery/nuclei/v2/pkg/catalog"
+	"github.com/projectdiscovery/nuclei/v2/pkg/catalog/config"
+	"github.com/projectdiscovery/nuclei/v2/pkg/catalog/loader"
+	"github.com/projectdiscovery/nuclei/v2/pkg/core"
+	"github.com/projectdiscovery/nuclei/v2/pkg/core/inputs"
+	"github.com/projectdiscovery/nuclei/v2/pkg/output"
+	"github.com/projectdiscovery/nuclei/v2/pkg/parsers"
+	"github.com/projectdiscovery/nuclei/v2/pkg/protocols"
+	"github.com/projectdiscovery/nuclei/v2/pkg/protocols/common/hosterrorscache"
+	"github.com/projectdiscovery/nuclei/v2/pkg/protocols/common/interactsh"
+	"github.com/projectdiscovery/nuclei/v2/pkg/protocols/common/protocolinit"
+	"github.com/projectdiscovery/nuclei/v2/pkg/protocols/common/protocolstate"
+	"github.com/projectdiscovery/nuclei/v2/pkg/reporting"
+	"github.com/projectdiscovery/nuclei/v2/pkg/testutils"
+	"github.com/projectdiscovery/nuclei/v2/pkg/types"
+)
+
+func main() {
+	cache := hosterrorscache.New(30, hosterrorscache.DefaultMaxHostsCount)
+	defer cache.Close()
+
+	mockProgress := &testutils.MockProgressClient{}
+	reportingClient, _ := reporting.New(&reporting.Options{}, "")
+	defer reportingClient.Close()
+
+	outputWriter := testutils.NewMockOutputWriter()
+	outputWriter.WriteCallback = func(event *output.ResultEvent) {
+		fmt.Printf("Got Result: %v\n", event)
+	}
+
+	defaultOpts := types.DefaultOptions()
+	protocolstate.Init(defaultOpts)
+	protocolinit.Init(defaultOpts)
+
+	defaultOpts.Templates = goflags.FileOriginalNormalizedStringSlice{"dns/cname-service-detection.yaml"}
+	defaultOpts.ExcludeTags = config.ReadIgnoreFile().Tags
+
+	interactOpts := interactsh.NewDefaultOptions(outputWriter, reportingClient, mockProgress)
+	interactClient, err := interactsh.New(interactOpts)
+	if err != nil {
+		log.Fatalf("Could not create interact client: %s\n", err)
+	}
+	defer interactClient.Close()
+
+	home, _ := os.UserHomeDir()
+	catalog := catalog.New(path.Join(home, "nuclei-templates"))
+	executerOpts := protocols.ExecuterOptions{
+		Output:          outputWriter,
+		Options:         defaultOpts,
+		Progress:        mockProgress,
+		Catalog:         catalog,
+		IssuesClient:    reportingClient,
+		RateLimiter:     ratelimit.New(150),
+		Interactsh:      interactClient,
+		HostErrorsCache: cache,
+		Colorizer:       aurora.NewAurora(true),
+		ResumeCfg:       types.NewResumeCfg(),
+	}
+	engine := core.New(defaultOpts)
+	engine.SetExecuterOptions(executerOpts)
+
+	workflowLoader, err := parsers.NewLoader(&executerOpts)
+	if err != nil {
+		log.Fatalf("Could not create workflow loader: %s\n", err)
+	}
+	executerOpts.WorkflowLoader = workflowLoader
+
+	configObject, err := config.ReadConfiguration()
+	if err != nil {
+		log.Fatalf("Could not read config: %s\n", err)
+	}
+	store, err := loader.New(loader.NewConfig(defaultOpts, configObject, catalog, executerOpts))
+	if err != nil {
+		log.Fatalf("Could not create loader client: %s\n", err)
+	}
+	store.Load()
+
+	input := &inputs.SimpleInputProvider{Inputs: []string{"docs.hackerone.com"}}
+	_ = engine.Execute(store.Templates(), input)
+	engine.WorkPool().Wait() // Wait for the scan to finish
+}
+```
+
+### Adding a New Protocol
+
+Protocols form the core of Nuclei Engine. All the request types like `http`, `dns`, etc. are implemented in form of protocol requests.
+
+A protocol must implement the `Protocol` and `Request` interfaces described above in `pkg/protocols`. We'll take the example of an existing protocol implementation - websocket for this short reference around Nuclei internals.
+
+The code for the websocket protocol is contained in `pkg/protocols/others/websocket`. 
+
+Below a high level skeleton of the websocket implementation is provided with all the important parts present.
+
+```go
+package websocket
+
+// Request is a request for the Websocket protocol
+type Request struct {
+	// Operators for the current request go here.
+	operators.Operators `yaml:",inline,omitempty"`
+	CompiledOperators   *operators.Operators `yaml:"-"`
+
+	// description: |
+	//   Address contains address for the request
+	Address string `yaml:"address,omitempty" jsonschema:"title=address for the websocket request,description=Address contains address for the request"`
+
+    // declarations here
+}
+
+// Compile compiles the request generators preparing any requests possible.
+func (r *Request) Compile(options *protocols.ExecuterOptions) error {
+	r.options = options
+
+    // request compilation here as well as client creation
+ 
+	if len(r.Matchers) > 0 || len(r.Extractors) > 0 {
+		compiled := &r.Operators
+		if err := compiled.Compile(); err != nil {
+			return errors.Wrap(err, "could not compile operators")
+		}
+		r.CompiledOperators = compiled
+	}
+	return nil
+}
+
+// Requests returns the total number of requests the rule will perform
+func (r *Request) Requests() int {
+	if r.generator != nil {
+		return r.generator.NewIterator().Total()
+	}
+	return 1
+}
+
+// GetID returns the ID for the request if any.
+func (r *Request) GetID() string {
+	return ""
+}
+
+// ExecuteWithResults executes the protocol requests and returns results instead of writing them.
+func (r *Request) ExecuteWithResults(input string, dynamicValues, previous output.InternalEvent, callback protocols.OutputEventCallback) error {
+    // payloads init here
+	if err := r.executeRequestWithPayloads(input, hostname, value, previous, callback); err != nil {
+		return err
+	}
+	return nil
+}
+
+// ExecuteWithResults executes the protocol requests and returns results instead of writing them.
+func (r *Request) executeRequestWithPayloads(input, hostname string, dynamicValues, previous output.InternalEvent, callback protocols.OutputEventCallback) error {
+	header := http.Header{}
+
+    // make the actual request here after setting all options
+
+	event := eventcreator.CreateEventWithAdditionalOptions(r, data, r.options.Options.Debug || r.options.Options.DebugResponse, func(internalWrappedEvent *output.InternalWrappedEvent) {
+		internalWrappedEvent.OperatorsResult.PayloadValues = payloadValues
+	})
+	if r.options.Options.Debug || r.options.Options.DebugResponse {
+		responseOutput := responseBuilder.String()
+		gologger.Debug().Msgf("[%s] Dumped Websocket response for %s", r.options.TemplateID, input)
+		gologger.Print().Msgf("%s", responsehighlighter.Highlight(event.OperatorsResult, responseOutput, r.options.Options.NoColor))
+	}
+
+	callback(event)
+	return nil
+}
+
+func (r *Request) MakeResultEventItem(wrapped *output.InternalWrappedEvent) *output.ResultEvent {
+	data := &output.ResultEvent{
+		TemplateID:       types.ToString(r.options.TemplateID),
+		TemplatePath:     types.ToString(r.options.TemplatePath),
+		// ... setting more values for result event
+	}
+	return data
+}
+
+// Match performs matching operation for a matcher on model and returns:
+// true and a list of matched snippets if the matcher type is supports it
+// otherwise false and an empty string slice
+func (r *Request) Match(data map[string]interface{}, matcher *matchers.Matcher) (bool, []string) {
+	return protocols.MakeDefaultMatchFunc(data, matcher)
+}
+
+// Extract performs extracting operation for an extractor on model and returns true or false.
+func (r *Request) Extract(data map[string]interface{}, matcher *extractors.Extractor) map[string]struct{} {
+	return protocols.MakeDefaultExtractFunc(data, matcher)
+}
+
+// MakeResultEvent creates a result event from internal wrapped event
+func (r *Request) MakeResultEvent(wrapped *output.InternalWrappedEvent) []*output.ResultEvent {
+	return protocols.MakeDefaultResultEvent(r, wrapped)
+}
+
+// GetCompiledOperators returns a list of the compiled operators
+func (r *Request) GetCompiledOperators() []*operators.Operators {
+	return []*operators.Operators{r.CompiledOperators}
+}
+
+// Type returns the type of the protocol request
+func (r *Request) Type() templateTypes.ProtocolType {
+	return templateTypes.WebsocketProtocol
+}
+```
+
+Almost all of these protocols have boilerplate functions for which default implementations have been provided in the `providers` package. Examples are the implementation of `Match`, `Extract`, `MakeResultEvent`, GetCompiledOperators`, etc. which are almost same throughout Nuclei protocols code. It is enough to copy-paste them unless customization is required.
+
+`eventcreator` package offers `CreateEventWithAdditionalOptions` function which can be used to create result events after doing request execution.
+
+Step by step description of how to add a new protocol to Nuclei - 
+
+1. Add the protocol implementation in `pkg/protocols` directory. If it's a small protocol with fewer options, considering adding it to the `pkg/protocols/others` directory. Add the enum for the new protocol to `v2/pkg/templates/types/types.go`.
+
+2. Add the protocol request structure to the `Template` structure fields. This is done in `pkg/templates/templates.go` with the corresponding import line.
+
+```go
+
+import (
+	...
+	"github.com/projectdiscovery/nuclei/v2/pkg/protocols/others/websocket"
+)
+
+// Template is a YAML input file which defines all the requests and
+// other metadata for a template.
+type Template struct {
+	...
+	// description: |
+	//   Websocket contains the Websocket request to make in the template.
+	RequestsWebsocket []*websocket.Request `yaml:"websocket,omitempty" json:"websocket,omitempty" jsonschema:"title=websocket requests to make,description=Websocket requests to make for the template"`
+	...
+}
+```
+
+Also add the protocol case to the `Type` function as well as the `TemplateTypes` array in the same `templates.go` file.
+
+```go
+// TemplateTypes is a list of accepted template types
+var TemplateTypes = []string{
+	...
+	"websocket",
+}
+
+// Type returns the type of the template
+func (t *Template) Type() templateTypes.ProtocolType {
+	...
+	case len(t.RequestsWebsocket) > 0:
+		return templateTypes.WebsocketProtocol
+	default:
+		return ""
+	}
+}
+```
+
+3. Add the protocol request to the `Requests` function and `compileProtocolRequests` function in the `compile.go` file in same directory.
+
+```go
+
+// Requests return the total request count for the template
+func (template *Template) Requests() int {
+	return len(template.RequestsDNS) +
+		...
+		len(template.RequestsSSL) +
+		len(template.RequestsWebsocket)
+}
+
+
+// compileProtocolRequests compiles all the protocol requests for the template
+func (template *Template) compileProtocolRequests(options protocols.ExecuterOptions) error {
+	...
+
+	case len(template.RequestsWebsocket) > 0:
+		requests = template.convertRequestToProtocolsRequest(template.RequestsWebsocket)
+	}
+	template.Executer = executer.NewExecuter(requests, &options)
+	return nil
+}
+```
+
+That's it, you've added a new protocol to Nuclei. The next good step would be to write integration tests which are described in `integration-tests` and `cmd/integration-tests` directories.
+
+## Project Structure
+
+- [v2/pkg/reporting](./v2/pkg/reporting) - Reporting modules for nuclei.
+- [v2/pkg/reporting/exporters/sarif](./v2/pkg/reporting/exporters/sarif) - Sarif Result Exporter
+- [v2/pkg/reporting/exporters/markdown](./v2/pkg/reporting/exporters/markdown) - Markdown Result Exporter
+- [v2/pkg/reporting/exporters/es](./v2/pkg/reporting/exporters/es) - Elasticsearch Result Exporter
+- [v2/pkg/reporting/dedupe](./v2/pkg/reporting/dedupe) - Dedupe module for Results
+- [v2/pkg/reporting/trackers/gitlab](./v2/pkg/reporting/trackers/gitlab) - Gitlab Issue Tracker Exporter
+- [v2/pkg/reporting/trackers/jira](./v2/pkg/reporting/trackers/jira) - Jira Issue Tracker Exporter
+- [v2/pkg/reporting/trackers/github](./v2/pkg/reporting/trackers/github) - GitHub Issue Tracker Exporter
+- [v2/pkg/reporting/format](./v2/pkg/reporting/format) - Result Formatting Functions
+- [v2/pkg/parsers](./v2/pkg/parsers) - Implements template as well as workflow loader for initial template discovery, validation and - loading.
+- [v2/pkg/types](./v2/pkg/types) - Contains CLI options as well as misc helper functions.
+- [v2/pkg/progress](./v2/pkg/progress) - Progress tracking
+- [v2/pkg/operators](./v2/pkg/operators) - Operators for Nuclei
+- [v2/pkg/operators/common/dsl](./v2/pkg/operators/common/dsl) - DSL functions for Nuclei YAML Syntax
+- [v2/pkg/operators/matchers](./v2/pkg/operators/matchers) - Matchers implementation
+- [v2/pkg/operators/extractors](./v2/pkg/operators/extractors) - Extractors implementation
+- [v2/pkg/catalog](./v2/pkg/catalog) - Template loading from disk helpers
+- [v2/pkg/catalog/config](./v2/pkg/catalog/config) - Internal configuration management
+- [v2/pkg/catalog/loader](./v2/pkg/catalog/loader) - Implements loading and validation of templates and workflows.
+- [v2/pkg/catalog/loader/filter](./v2/pkg/catalog/loader/filter) - Filter filters templates based on tags and paths
+- [v2/pkg/output](./v2/pkg/output) - Output module for nuclei
+- [v2/pkg/workflows](./v2/pkg/workflows) - Workflow execution logic + declarations
+- [v2/pkg/utils](./v2/pkg/utils) - Utility functions
+- [v2/pkg/model](./v2/pkg/model) - Template Info + misc
+- [v2/pkg/templates](./v2/pkg/templates) - Templates core starting point
+- [v2/pkg/templates/cache](./v2/pkg/templates/cache) - Templates cache
+- [v2/pkg/protocols](./v2/pkg/protocols) - Protocol Specification
+- [v2/pkg/protocols/file](./v2/pkg/protocols/file) - File protocol
+- [v2/pkg/protocols/network](./v2/pkg/protocols/network) - Network protocol
+- [v2/pkg/protocols/common/expressions](./v2/pkg/protocols/common/expressions) - Expression evaluation + Templating Support
+- [v2/pkg/protocols/common/interactsh](./v2/pkg/protocols/common/interactsh) - Interactsh integration
+- [v2/pkg/protocols/common/generators](./v2/pkg/protocols/common/generators) - Payload support for Requests (Sniper, etc.)
+- [v2/pkg/protocols/common/executer](./v2/pkg/protocols/common/executer) - Default Template Executer
+- [v2/pkg/protocols/common/replacer](./v2/pkg/protocols/common/replacer) - Template replacement helpers
+- [v2/pkg/protocols/common/helpers/eventcreator](./v2/pkg/protocols/common/helpers/eventcreator) - Result event creator
+- [v2/pkg/protocols/common/helpers/responsehighlighter](./v2/pkg/protocols/common/helpers/responsehighlighter) - Debug response highlighter
+- [v2/pkg/protocols/common/helpers/deserialization](./v2/pkg/protocols/common/helpers/deserialization) - Deserialization helper functions
+- [v2/pkg/protocols/common/hosterrorscache](./v2/pkg/protocols/common/hosterrorscache) - Host errors cache for tracking erroring hosts
+- [v2/pkg/protocols/offlinehttp](./v2/pkg/protocols/offlinehttp) - Offline http protocol
+- [v2/pkg/protocols/http](./v2/pkg/protocols/http) - HTTP protocol
+- [v2/pkg/protocols/http/race](./v2/pkg/protocols/http/race) - HTTP Race Module
+- [v2/pkg/protocols/http/raw](./v2/pkg/protocols/http/raw) - HTTP Raw Request Support
+- [v2/pkg/protocols/headless](./v2/pkg/protocols/headless) - Headless Module
+- [v2/pkg/protocols/headless/engine](./v2/pkg/protocols/headless/engine) - Internal Headless implementation
+- [v2/pkg/protocols/dns](./v2/pkg/protocols/dns) - DNS protocol
+- [v2/pkg/projectfile](./v2/pkg/projectfile) - Project File Implementation
+
+### Notes
+
+1. The matching as well as interim output functionality is a bit complex, we should simplify it a bit as well.

Dockerfile

@@ -1,7 +1,7 @@
-FROM golang:1.15-alpine as build-env
-RUN GO111MODULE=on go get -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei
+FROM golang:1.18.3-alpine as build-env
+RUN go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
 
-FROM alpine:latest
-RUN apk add --no-cache bind-tools ca-certificates
+FROM alpine:3.16.0
+RUN apk add --no-cache bind-tools ca-certificates chromium
 COPY --from=build-env /go/bin/nuclei /usr/local/bin/nuclei
 ENTRYPOINT ["nuclei"]

README.md

@@ -7,12 +7,14 @@
 
 
 <p align="center">
-<a href="https://goreportcard.com/report/github.com/projectdiscovery/nuclei"><img src="https://goreportcard.com/badge/github.com/projectdiscovery/nuclei"></a>
-<a href="https://github.com/projectdiscovery/nuclei/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
-<a href="https://github.com/projectdiscovery/nuclei/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei"></a>
+<img src="https://img.shields.io/github/go-mod/go-version/projectdiscovery/nuclei?filename=v2%2Fgo.mod">
+<a href="https://github.com/projectdiscovery/nuclei/releases"><img src="https://img.shields.io/github/downloads/projectdiscovery/nuclei/total">
+<a href="https://github.com/projectdiscovery/nuclei/graphs/contributors"><img src="https://img.shields.io/github/contributors-anon/projectdiscovery/nuclei">
+<a href="https://github.com/projectdiscovery/nuclei/releases/"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei">
+<a href="https://github.com/projectdiscovery/nuclei/issues"><img src="https://img.shields.io/github/issues-raw/projectdiscovery/nuclei">
+<a href="https://github.com/projectdiscovery/nuclei/discussions"><img src="https://img.shields.io/github/discussions/projectdiscovery/nuclei">
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
 <a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
-<a href="https://discord.gg/KECAGdH"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
-<a href="https://github.com/projectdiscovery/nuclei/actions/workflows/build.yaml"><img src="https://github.com/projectdiscovery/nuclei/actions/workflows/build.yaml/badge.svg?branch=master"></a>
 </p>
       
 <p align="center">
@@ -22,15 +24,20 @@
   <a href="#for-developers-and-organisations">For Developers</a> •
   <a href="https://nuclei.projectdiscovery.io/nuclei/get-started/">Documentation</a> •
   <a href="#credits">Credits</a> •
-  <a href="#license">License</a> •
-  <a href="https://discord.gg/KECAGdH">Join Discord</a>
+  <a href="https://nuclei.projectdiscovery.io/faq/nuclei/">FAQs</a> •
+  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/projectdiscovery/nuclei/blob/master/README.md">English</a> •
+  <a href="https://github.com/projectdiscovery/nuclei/blob/master/README_CN.md">中文</a>
 </p>
 
 ---
 
-Nuclei is used to send requests across targets based on a template leading to zero false positives and providing fast scanning on large number of hosts. Nuclei offers scanning for a variety of protocols including TCP, DNS, HTTP, File, etc. With powerful and flexible templating, all kinds of security checks can be modelled with Nuclei.
+Nuclei is used to send requests across targets based on a template, leading to zero false positives and providing fast scanning on a large number of hosts. Nuclei offers scanning for a variety of protocols, including TCP, DNS, HTTP, SSL, File, Whois, Websocket, Headless etc. With powerful and flexible templating, Nuclei can be used to model all kinds of security checks.
 
-We have a [dedicated repository](https://github.com/projectdiscovery/nuclei-templates) that houses various type of vulnerability templates contributed by **more than 100** security researchers and engineers. It is preloaded with ready to use templates using `-update-templates` flag.
+We have a [dedicated repository](https://github.com/projectdiscovery/nuclei-templates) that houses various type of vulnerability templates contributed by **more than 300** security researchers and engineers.
 
 
 
@@ -44,34 +51,193 @@ We have a [dedicated repository](https://github.com/projectdiscovery/nuclei-temp
 
 # Install Nuclei
 
+Nuclei requires **go1.17** to install successfully. Run the following command to install the latest version -
+
 ```sh
-▶ GO111MODULE=on go get -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei
+go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
 ```
 
-**More installation [methods can be found here](https://nuclei.projectdiscovery.io/nuclei/get-started/#nuclei-installation).**
+**More installation [methods can be found here](https://nuclei.projectdiscovery.io/nuclei/get-started/).**
 
 <table>
 <tr>
 <td>  
 
-### Download Templates
+### Nuclei Templates
 
-You can download and update the nuclei templates using <ins>*update-templates*</ins> flag of nuclei that downloads all the available **nuclei-templates** from [Github project](https://github.com/projectdiscovery/nuclei-templates), a community curated list of templates that are ready to use.
+Nuclei has built-in support for automatic template download/update as default since version [v2.5.2](https://github.com/projectdiscovery/nuclei/releases/tag/v2.5.2). [**Nuclei-Templates**](https://github.com/projectdiscovery/nuclei-templates) project provides a community-contributed list of ready-to-use templates that is constantly updated.
 
-`▶ nuclei -update-templates`
+You may still use the `update-templates` flag to update the nuclei templates at any time; You can write your own checks for your individual workflow and needs following Nuclei's [templating guide](https://nuclei.projectdiscovery.io/templating-guide/).
 
-Nuclei is designed to used with custom templates according to the target and workflow, you can write your own checks for your specific workflow and needs, please refer to nuclei [templating guide](https://nuclei.projectdiscovery.io/templating-guide/) to write your own custom templates.
+The YAML DSL reference syntax is available [here](SYNTAX-REFERENCE.md).
 
 </td>
 </tr>
 </table>
 
-### Running Nuclei
-
-Scanning for CVEs on given list of URLs.
+### Usage
 
 ```sh
-▶ nuclei -l target_urls.txt -t cves/
+nuclei -h
+```
+
+This will display help for the tool. Here are all the switches it supports.
+
+
+```console
+Nuclei is a fast, template based vulnerability scanner focusing
+on extensive configurability, massive extensibility and ease of use.
+
+Usage:
+  nuclei [flags]
+
+Flags:
+TARGET:
+   -u, -target string[]  target URLs/hosts to scan
+   -l, -list string      path to file containing a list of target URLs/hosts to scan (one per line)
+   -resume string        Resume scan using resume.cfg (clustering will be disabled)
+
+TEMPLATES:
+   -nt, -new-templates          run only new templates added in latest nuclei-templates release
+   -as, -automatic-scan         automatic web scan using wappalyzer technology detection to tags mapping
+   -t, -templates string[]      list of template or template directory to run (comma-separated, file)
+   -tu, -template-url string[]  list of template urls to run (comma-separated, file)
+   -w, -workflows string[]      list of workflow or workflow directory to run (comma-separated, file)
+   -wu, -workflow-url string[]  list of workflow urls to run (comma-separated, file)
+   -validate                    validate the passed templates to nuclei
+   -tl                          list all available templates
+
+FILTERING:
+   -a, -author string[]              templates to run based on authors (comma-separated, file)
+   -tags string[]                    templates to run based on tags (comma-separated, file)
+   -etags, -exclude-tags string[]    templates to exclude based on tags (comma-separated, file)
+   -itags, -include-tags string[]    tags to be executed even if they are excluded either by default or configuration
+   -id, -template-id string[]        templates to run based on template ids (comma-separated, file)
+   -eid, -exclude-id string[]        templates to exclude based on template ids (comma-separated, file)
+   -it, -include-templates string[]  templates to be executed even if they are excluded either by default or configuration
+   -et, -exclude-templates string[]  template or template directory to exclude (comma-separated, file)
+   -s, -severity value[]             templates to run based on severity. Possible values: info, low, medium, high, critical, unknown
+   -es, -exclude-severity value[]    templates to exclude based on severity. Possible values: info, low, medium, high, critical, unknown
+   -pt, -type value[]                templates to run based on protocol type. Possible values: dns, file, http, headless, network, workflow, ssl, websocket, whois
+   -ept, -exclude-type value[]       templates to exclude based on protocol type. Possible values: dns, file, http, headless, network, workflow, ssl, websocket, whois
+
+OUTPUT:
+   -o, -output string            output file to write found issues/vulnerabilities
+   -sresp, -store-resp           store all request/response passed through nuclei to output directory
+   -srd, -store-resp-dir string  store all request/response passed through nuclei to custom directory (default "output")
+   -silent                       display findings only
+   -nc, -no-color                disable output content coloring (ANSI escape codes)
+   -json                         write output in JSONL(ines) format
+   -irr, -include-rr             include request/response pairs in the JSONL output (for findings only)
+   -nm, -no-meta                 disable printing result metadata in cli output
+   -nts, -no-timestamp           disable printing timestamp in cli output
+   -rdb, -report-db string       nuclei reporting database (always use this to persist report data)
+   -ms, -matcher-status          display match failure status
+   -me, -markdown-export string  directory to export results in markdown format
+   -se, -sarif-export string     file to export results in SARIF format
+
+CONFIGURATIONS:
+   -config string              path to the nuclei configuration file
+   -fr, -follow-redirects      enable following redirects for http templates
+   -mr, -max-redirects int     max number of redirects to follow for http templates (default 10)
+   -dr, -disable-redirects     disable redirects for http templates
+   -rc, -report-config string  nuclei reporting module configuration file
+   -H, -header string[]        custom header/cookie to include in all http request in header:value format (cli, file)
+   -V, -var value              custom vars in key=value format
+   -r, -resolvers string       file containing resolver list for nuclei
+   -sr, -system-resolvers      use system DNS resolving as error fallback
+   -passive                    enable passive HTTP response processing mode
+   -ev, -env-vars              enable environment variables to be used in template
+   -cc, -client-cert string    client certificate file (PEM-encoded) used for authenticating against scanned hosts
+   -ck, -client-key string     client key file (PEM-encoded) used for authenticating against scanned hosts
+   -ca, -client-ca string      client certificate authority file (PEM-encoded) used for authenticating against scanned hosts
+   -sml, -show-match-line      show match lines for file templates, works with extractors only
+   -ztls                       use ztls library with autofallback to standard one for tls13
+   -sni string                 tls sni hostname to use (default: input domain name)
+
+INTERACTSH:
+   -iserver, -interactsh-server string  interactsh server url for self-hosted instance (default: oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me)
+   -itoken, -interactsh-token string    authentication token for self-hosted interactsh server
+   -interactions-cache-size int         number of requests to keep in the interactions cache (default 5000)
+   -interactions-eviction int           number of seconds to wait before evicting requests from cache (default 60)
+   -interactions-poll-duration int      number of seconds to wait before each interaction poll request (default 5)
+   -interactions-cooldown-period int    extra time for interaction polling before exiting (default 5)
+   -ni, -no-interactsh                  disable interactsh server for OAST testing, exclude OAST based templates
+
+RATE-LIMIT:
+   -rl, -rate-limit int            maximum number of requests to send per second (default 150)
+   -rlm, -rate-limit-minute int    maximum number of requests to send per minute
+   -bs, -bulk-size int             maximum number of hosts to be analyzed in parallel per template (default 25)
+   -c, -concurrency int            maximum number of templates to be executed in parallel (default 25)
+   -hbs, -headless-bulk-size int   maximum number of headless hosts to be analyzed in parallel per template (default 10)
+   -hc, -headless-concurrency int  maximum number of headless templates to be executed in parallel (default 10)
+
+OPTIMIZATIONS:
+   -timeout int                time to wait in seconds before timeout (default 5)
+   -retries int                number of times to retry a failed request (default 1)
+   -ldp, -leave-default-ports  leave default HTTP/HTTPS ports (eg. host:80,host:443
+   -mhe, -max-host-error int   max errors for a host before skipping from scan (default 30)
+   -project                    use a project folder to avoid sending same request multiple times
+   -project-path string        set a specific project path
+   -spm, -stop-at-first-path   stop processing HTTP requests after the first match (may break template/workflow logic)
+   -stream                     stream mode - start elaborating without sorting the input
+
+HEADLESS:
+   -headless            enable templates that require headless browser support (root user on linux will disable sandbox)
+   -page-timeout int    seconds to wait for each page in headless mode (default 20)
+   -sb, -show-browser   show the browser on the screen when running templates with headless mode
+   -sc, -system-chrome  Use local installed chrome browser instead of nuclei installed
+
+DEBUG:
+   -debug                    show all requests and responses
+   -dreq, -debug-req         show all sent requests
+   -dresp, -debug-resp       show all received responses
+   -p, -proxy string[]       list of http/socks5 proxy to use (comma separated or file input)
+   -pi, -proxy-internal      proxy all internal requests
+   -tlog, -trace-log string  file to write sent requests trace log
+   -elog, -error-log string  file to write sent requests error log
+   -version                  show nuclei version
+   -hm, -hang-monitor        enable nuclei hang monitoring
+   -v, -verbose              show verbose output
+   -vv                       display templates loaded for scan
+   -ep, -enable-pprof        enable pprof debugging server
+   -tv, -templates-version   shows the version of the installed nuclei-templates
+
+UPDATE:
+   -update                        update nuclei engine to the latest released version
+   -ut, -update-templates         update nuclei-templates to latest released version
+   -ud, -update-directory string  overwrite the default directory to install nuclei-templates
+   -duc, -disable-update-check    disable automatic nuclei/templates update check
+
+STATISTICS:
+   -stats                    display statistics about the running scan
+   -sj, -stats-json          write statistics data to an output file in JSONL(ines) format
+   -si, -stats-interval int  number of seconds to wait between showing a statistics update (default 5)
+   -m, -metrics              expose nuclei metrics on a port
+   -mp, -metrics-port int    port to expose nuclei metrics on (default 9092)
+```
+
+### Running Nuclei
+
+Scanning target domain with [community-curated](https://github.com/projectdiscovery/nuclei-templates) nuclei templates.
+
+```sh
+nuclei -u https://example.com
+```
+
+Scanning target URLs with [community-curated](https://github.com/projectdiscovery/nuclei-templates) nuclei templates.
+
+```sh
+nuclei -list urls.txt
+```
+
+Example of `urls.txt`:
+
+```yaml
+http://example.com
+http://app.example.com
+http://test.example.com
+http://uat.example.com
 ```
 
 **More detailed examples of running nuclei can be found [here](https://nuclei.projectdiscovery.io/nuclei/get-started/#running-nuclei).**
@@ -92,9 +258,9 @@ Nuclei offers great number of features that are helpful for security engineers t
 <tr>
 <td>  
 
-**For bugbounty hunters:**
+**For Bug Bounty hunters:**
 
-Nuclei allows you to customise your testing approach with your own suite of checks and easily run across your bug bounty programs. Moroever, Nuclei can be easily integrated into any continuous scanning workflow.
+Nuclei allows you to customise your testing approach with your own suite of checks and easily run across your bug bounty programs. Moreover, Nuclei can be easily integrated into any continuous scanning workflow.
 
 - Designed to be easily integrated into other tool workflow.
 - Can process thousands of hosts in few minutes.
@@ -110,11 +276,11 @@ Please check our other open-source projects that might fit into your bug bounty
 <tr>
 <td>
   
-**For pentesters:**
+**For Penetration Testers:**
 
-Nuclei immensely improve how you approach security assessment by augmenting the manual repetitve processes. Consultancies are already converting their manual assessment steps with Nuclei, it allows them to run set of their custom assessment approach across thousands of hosts in an automated manner. 
+Nuclei immensely improve how you approach security assessment by augmenting the manual, repetitive processes. Consultancies are already converting their manual assessment steps with Nuclei, it allows them to run set of their custom assessment approach across thousands of hosts in an automated manner. 
 
-Pen-testers get the full power of our public templates and customization capabilities to speed-up their assessment process, and specifically with the regression cycle where you can easily verify the fix.
+Pen-testers get the full power of our public templates and customization capabilities to speed up their assessment process, and specifically with the regression cycle where you can easily verify the fix.
 
 - Easily create your compliance, standards suite (e.g. OWASP Top 10) checklist.
 - With capabilities like [fuzz](https://nuclei.projectdiscovery.io/templating-guide/#advance-fuzzing) and [workflows](https://nuclei.projectdiscovery.io/templating-guide/#workflows), complex manual steps and repetitive assessment can be easily automated with Nuclei.
@@ -127,7 +293,7 @@ Pen-testers get the full power of our public templates and customization capabil
 
 # For Developers and Organisations
 
-Nuclei is built with simplicity in mind, with the community backed templates by hundreds of security researchers, it allows you to stay updated with latest security threats using continuous Nuclei scanning on the hosts. It is designed to be easily integrated into regression tests cycle, to verify the fixes and  eliminate vulnerabilities from occuring in future.
+Nuclei is built with simplicity in mind, with the community backed templates by hundreds of security researchers, it allows you to stay updated with the latest security threats using continuous Nuclei scanning on the hosts. It is designed to be easily integrated into regression tests cycle, to verify the fixes and eliminate vulnerabilities from occurring in the future.
 
 - **CI/CD:** Engineers are already utilising Nuclei within their CI/CD pipeline, it allows them to constantly monitor their staging and production environments with customised templates.
 - **Continuous Regression Cycle:** With Nuclei, you can create your custom template on every new identified vulnerability and put into Nuclei engine to eliminate in the continuous regression cycle.
@@ -144,11 +310,17 @@ We have [a discussion thread around this](https://github.com/projectdiscovery/nu
 
 ### Resources
 
+- [Finding bugs with Nuclei with PinkDraconian (Robbe Van Roey)](https://www.youtube.com/watch?v=ewP0xVPW-Pk) by **[@PinkDraconian](https://twitter.com/PinkDraconian)** 
+- [Nuclei: Packing a Punch with Vulnerability Scanning](https://bishopfox.com/blog/nuclei-vulnerability-scan) by **Bishopfox**
+- [The WAF efficacy framework](https://www.fastly.com/blog/the-waf-efficacy-framework-measuring-the-effectiveness-of-your-waf) by **Fastly**
+- [Scanning Live Web Applications with Nuclei in CI/CD Pipeline](https://blog.escape.tech/devsecops-part-iii-scanning-live-web-applications/) by **[@TristanKalos](https://twitter.com/TristanKalos)**
 - [Community Powered Scanning with Nuclei](https://blog.projectdiscovery.io/community-powered-scanning-with-nuclei/)
 - [Nuclei Unleashed - Quickly write complex exploits](https://blog.projectdiscovery.io/nuclei-unleashed-quickly-write-complex-exploits/)
 - [Nuclei - Fuzz all the things](https://blog.projectdiscovery.io/nuclei-fuzz-all-the-things/)
-- [Weaponizes nuclei Workflows to Pwn All the Things](https://medium.com/@dwisiswant0/weaponizes-nuclei-workflows-to-pwn-all-the-things-cd01223feb77) by [@dwisiswant0](https://github.com/dwisiswant0)
-- [How to Scan Continuously with Nuclei?](https://medium.com/@dwisiswant0/how-to-scan-continuously-with-nuclei-fcb7e9d8b8b9) by [@dwisiswant0](https://github.com/dwisiswant0)
+- [Nuclei + Interactsh Integration for Automating OOB Testing](https://blog.projectdiscovery.io/nuclei-interactsh-integration/)
+- [Weaponizes nuclei Workflows to Pwn All the Things](https://medium.com/@dwisiswant0/weaponizes-nuclei-workflows-to-pwn-all-the-things-cd01223feb77) by **[@dwisiswant0](https://github.com/dwisiswant0)**
+- [How to Scan Continuously with Nuclei?](https://medium.com/@dwisiswant0/how-to-scan-continuously-with-nuclei-fcb7e9d8b8b9) by **[@dwisiswant0](https://github.com/dwisiswant0)**
+- [Hack with Automation !!!](https://dhiyaneshgeek.github.io/web/security/2021/07/19/hack-with-automation/) by **[@DhiyaneshGeek](https://github.com/DhiyaneshGeek)**
 
 ### Credits
 
@@ -161,5 +333,5 @@ Thanks to all the amazing community [contributors for sending PRs](https://githu
 Nuclei is distributed under [MIT License](https://github.com/projectdiscovery/nuclei/blob/master/LICENSE.md)
 
 <h1 align="left">
-  <a href="https://discord.gg/KECAGdH"><img src="static/Join-Discord.png" width="380" alt="Join Discord"></a> <a href="https://nuclei.projectdiscovery.io"><img src="static/check-nuclei-documentation.png" width="380" alt="Check Nuclei Documentation"></a>
+  <a href="https://discord.gg/projectdiscovery"><img src="static/Join-Discord.png" width="380" alt="Join Discord"></a> <a href="https://nuclei.projectdiscovery.io"><img src="static/check-nuclei-documentation.png" width="380" alt="Check Nuclei Documentation"></a>
 </h1>

README_CN.md

@@ -1,253 +1,303 @@
 <h1 align="center">
-  <img src="static/nuclei-logo.png" alt="nuclei" width="200px"></a>
   <br>
+  <a href="https://nuclei.projectdiscovery.io"><img src="static/nuclei-logo.png" width="200px" alt="Nuclei"></a>
 </h1>
 
-[![License](https://img.shields.io/badge/license-MIT-_red.svg)](https://opensource.org/licenses/MIT)
-[![Go Report Card](https://goreportcard.com/badge/github.com/projectdiscovery/nuclei)](https://goreportcard.com/report/github.com/projectdiscovery/nuclei)
-[![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/projectdiscovery/nuclei/issues)
-[![GitHub Release](https://img.shields.io/github/release/projectdiscovery/nuclei)](https://github.com/projectdiscovery/nuclei/releases)
-[![Follow on Twitter](https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter)](https://twitter.com/pdnuclei)
-[![Docker Images](https://img.shields.io/docker/pulls/projectdiscovery/nuclei.svg)](https://hub.docker.com/r/projectdiscovery/nuclei)
-[![Chat on Discord](https://img.shields.io/discord/695645237418131507.svg?logo=discord)](https://discord.gg/KECAGdH)
+<h4 align="center">基于YAML语法模板的定制化快速漏洞扫描器</h4>
+
 
 <p align="center">
-<a href="https://nuclei.projectdiscovery.io/templating-guide/" target="_blank"><img src="static/read-the-docs-button.png" height="42px"/></center></a>  <a href="https://github.com/projectdiscovery/nuclei-templates" target="_blank"><img src="static/download-templates-button.png" height="42px"/></a>
+<a href="https://goreportcard.com/report/github.com/projectdiscovery/nuclei"><img src="https://goreportcard.com/badge/github.com/projectdiscovery/nuclei"></a>
+<a href="https://github.com/projectdiscovery/nuclei/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
+<a href="https://github.com/projectdiscovery/nuclei/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei"></a>
+<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
+<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
+<a href="https://github.com/projectdiscovery/nuclei/actions/workflows/build-test.yml"><img src="https://github.com/projectdiscovery/nuclei/actions/workflows/build-test.yml/badge.svg?branch=master"></a>
+</p>
+      
+<p align="center">
+  <a href="#工作流程">工作流程</a> •
+  <a href="#安装Nuclei">安装</a> •
+  <a href="#对于安全工程师">对于安全工程师</a> •
+  <a href="#对于开发者和组织">对于开发者</a> •
+  <a href="https://nuclei.projectdiscovery.io/nuclei/get-started/">文档</a> •
+  <a href="#c致谢">致谢</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/nuclei/">常见问题</a> •
+  <a href="https://discord.gg/projectdiscovery">加入Discord</a>
 </p>
 
+<p align="center">
+  <a href="https://github.com/projectdiscovery/nuclei/blob/master/README.md">English</a> •
+  <a href="https://github.com/projectdiscovery/nuclei/blob/master/README_CN.md">中文</a>
+</p>
 
-Nuclei是一个基于模板的、可配置攻击目标的扫描快速工具，同时还提供了强大的可扩展性和易用性。
+---
 
-基于模板的nuclei被用来发送请求给目标，有着实现零误报的优点，并且可以对已知的路径进行有效的扫描。nuclei的主要用于在初期的探测阶段快速地对已知的且易于检测的漏洞或者CVE进行扫描。如果存在WAF的话，nuclei使用[retryablehttp-go库](https://github.com/projectdiscovery/retryablehttp-go)来处理各种错误，并且重新尝试攻击，这也是我们自定义功能的核心模块之一。
+Nuclei使用零误报的定制模板向目标发送请求，同时可以对大量主机进行快速扫描。Nuclei提供TCP、DNS、HTTP、FILE等各类协议的扫描，通过强大且灵活的模板，可以使用Nuclei模拟各种安全检查。
 
-我们也维护一个具有各个类型的模板的[开源库](https://github.com/projectdiscovery/nuclei-templates)，我们希望你也能贡献一些模板，贡献的这些模板最好是有效的，并且能允许每个人基于你的模板重新构建。查看[**nuclei.projectdiscovery.io**](https://nuclei.projectdiscovery.io/templating-guide/)这个网站去学习制作模板的入门知识。
+我们的[模板仓库](https://github.com/projectdiscovery/nuclei-templates)包含**超过200**安全研究员和工程师提供的模板。
 
-## 目录
 
-- [目录](#目录)
-- [功能](#功能)
-- [安装](#安装)
-- [Nuclei模板](#nuclei模板)
-- [用法](#用法)
-- [运行Nuclei](#运行nuclei)
-- [排除模板](#排除模板)
-- [致谢](#致谢)
 
-## 功能
+## 工作流程
 
-<h1 align="left">
-  <img src="static/nuclei-run.png" alt="nuclei" width="700px"></a>
-  <br>
-</h1>
 
-- 有着易于开发的、简单的、模块化的代码库
-- 使用了基于模板的引擎，运行速度极快，可以修改所以配置
-- 可以对特殊情况处理、重试、绕过等，可以绕过WAF
-- 智能匹配，零误报
+<h3 align="center">
+  <img src="static/nuclei-flow.jpg" alt="nuclei-flow" width="700px"></a>
+</h3>
 
-## 安装
 
-### 二进制文件安装
+# 安装Nuclei
 
-二进制文件安装很简单，你可以从[Releases](https://github.com/projectdiscovery/nuclei/releases/)页面下载已经构建好的二进制文件压缩包，使用解压工具提取下载的压缩包，并将解压的文件夹移动到$PATH目录，就可以直接使用了。
+Nuclei需要**go1.17**才能安装成功。执行下列命令安装最新版本的Nuclei
 
 ```sh
-Download latest binary from https://github.com/projectdiscovery/nuclei/releases
-
-▶ tar -xzvf nuclei-linux-amd64.tar.gz
-▶ mv nuclei /usr/local/bin/
-▶ nuclei -version
+go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
 ```
 
-### 源码安装
+**更多的安装方式 [请点击此处](https://nuclei.projectdiscovery.io/nuclei/get-started/).**
 
-nuclei需要**go1.14+**才能成功安装，运行以下命令获取repo
+<table>
+<tr>
+<td>  
 
-```sh
-▶ GO111MODULE=on go get -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei
-```
+### Nuclei模板
 
-### GitHub安装
+自从[v2.5.2]((https://github.com/projectdiscovery/nuclei/releases/tag/v2.5.2))起，Nuclei就内置了自动下载和更新模板的功能。[**Nuclei模板**](https://github.com/projectdiscovery/nuclei-templates)仓库随时更新社区中可用的模板列表。
 
-```sh
-▶ git clone https://github.com/projectdiscovery/nuclei.git; cd nuclei/v2/cmd/nuclei/; go build; mv nuclei /usr/local/bin/; nuclei -version
-```
+您仍然可以随时使用`update-templates`命令更新模板，您可以根据[模板指南](https://nuclei.projectdiscovery.io/templating-guide/)编写您自己的模板。
 
-## Nuclei模板
+YAML的语法规范在[这里](SYNTAX-REFERENCE.md)。
 
-你可以使用`update-templates`来下载和更新nuclei模板，该命令会从unclei的[模板库]()中下载最新版本，这个由社区来维护的库是可以随时使用的。
+</td>
+</tr>
+</table>
 
-```sh
-▶ nuclei -update-templates
-```
-
-此外您可以根据自己的工作情况或者需求编写模板，请参阅**nuclei[模板向导](https://nuclei.projectdiscovery.io/templating-guide/)去编写自定义模板**
-
-## 用法
+### 用法
 
 ```sh
 nuclei -h
 ```
 
-这条命令会显示帮助，以下是nuclei支持的所有命令
+这将显示Nuclei的帮助，以下是所有支持的命令
 
-|命令|描述|例子|
-|-----|-----|-----|
-|bulk-size|每个模板最大并行的主机数(默认25)|nuclei -bulk-size 25|
-|burp-collaborator-biid|使用burp-collaborator插件|nuclei -burp-collaborator-biid XXXX|
-|c|并行的最大模板数量(默认10)|nuclei -c 10|
-|l|对URL列表进行测试|nuclei -l urls.txt|
-|target|对目标进行测试|nuclei -target hxxps://example.com|
-|t|要检测的模板种类|nuclei -t git-core.yaml -t cves/|
-|no-color|输出不显示颜色|nuclei -no-color|
-|no-meta|不显示匹配的元数据|nuclei -no-meta|
-|json|输出为json格式|nuclei -json|
-|include-rr|json输出格式中包含请求和响应数据|nuclei -json -include-rr|
-|o|输出为文件|nuclei -o output.txt|
-|project|避免发送相同的请求|nuclei -project|
-|stats|使用进度条|nuclei -stats|
-|silent|只输出测试成功的结果|nuclei -silent|
-|retries|失败后的重试次数|nuclei -retries 1|
-|timeout|超时时间(默认为5秒)|nuclei -timeout 5|
-|trace-log|输出日志到log文件|nuclei -trace-log logs|
-|rate-limit|每秒最大请求数(默认150)|nuclei -rate-limit 150|
-|severity|根据严重性选择模板|nuclei  -severity critical,high|
-|stop-at-first-match|第一次匹配不要处理HTTP请求|nuclei -stop-at-frst-match|
-|exclude|排除的模板或文件夹|nuclei -exclude panels -exclude tokens|
-|debug|调试请求或者响应|nuclei -debug|
-|update-templates|下载或者升级模板|nuclei -update-templates|
-|update-directory|选择储存模板的目录(可选)|nuclei -update-directory templates|
-|tl|列出可用的模板|nuclei -tl|
-|templates-version|显示已安装的模板版本|nuclei -templates-version|
-|v|显示发送请求的详细信息|nuclei -v|
-|version|显示nuclei的版本号|nuclei -version|
-|proxy-url|输入代理地址|nuclei -proxy-url hxxp://127.0.0.1:8080|
-|proxy-socks-url|输入socks代理地址|nuclei -proxy-socks-url socks5://127.0.0.1:8080|
-|random-agent|使用随机的UA|nuclei -random-agent|
-|H|自定义请求头|nuclei -H “x-bug-bounty:hacker”|
 
-## 运行Nuclei
+```yaml
+Nuclei是一款注重于可配置性、可扩展性和易用性的基于模板的快速漏洞扫描器。
 
-### 运行单个模板
+用法：
+  nuclei [命令]
 
-这将对`urls.txt`中所有的主机运行`git-core.yaml`并返回结果到`results.txt`
+命令：
+目标：
+   -u, -target string[]                 指定扫描的URL/主机
+   -l, -list string                     指定需要扫描的URL/主机文件（一行一个）
+
+模板：
+   -t, -templates string[]              指定需要扫描的模板或者模板的路径
+   -nt, -new-templates                  只扫描最新版本中添加的模板
+   -w, -workflows string[]              指定扫描中的工作流或者工作流目录
+   -validate                            验证通过的模板
+   -tl                                  列出所有可用的模板
+
+过滤：
+   -tags string[]                       执行有标记的模板子集
+   -etags, -exclude-tags string[]       执行标记为排除的模板
+   -itags, -include-tags string[]       不执行具有攻击性的模板
+   -et, -exclude-templates string[]     要排除的模板或者模板目录
+   -it, -include-templates string[]     执行默认或配置中排除的模板
+   -s, -severity value[]                根据严重程度运行模板，可候选的值有：info,low,medium,high,critical   
+   -es, -exclude-severity value[]       根据严重程度排除模板，可候选的值有：info,low,medium,high,critical   
+   -a, -author string[]                 执行指定作者的模板
+
+输出：
+   -o, -output string                   输出发现的问题到文件
+   -silent                              只显示结果
+   -nc, -no-color                       禁用输出内容着色（ANSI转义码）
+   -json                                输出为jsonL（ines）
+   -irr, -include-rr                    在JSONL中输出对应的请求和相应（仅结果）
+   -nm, -no-meta                        不显示匹配的元数据
+   -nts, -no-timestamp                  不在输出中显示时间戳
+   -rdb, -report-db string              本地的Nuclei结果数据库（始终使用该数据库保存结果）       
+   -me, -markdown-export string         以markdown导出结果
+   -se, -sarif-export string            以SARIF导出结果
+
+配置：
+   -config string                       指定Nuclei的配置文件
+   -rc, -report-config string           指定Nuclei报告模板文件
+   -H, -header string[]                 指定报告中的标题：value格式
+   -V, -var value                       通过var=value指定var值
+   -r, -resolvers string                指定Nuclei的解析文件
+   -sr, -system-resolvers               当DNS错误时使用系统DNS
+   -passive                             启用被动扫描处理HTTP响应
+   -ev, env-vars                        在模板中使用环境变量
+
+交互：
+   -inserver, -ineractsh-server string  使用interactsh反连检测平台（默认为"https://interact.sh"）
+   -itoken, -interactsh-token string    指定反连检测平台的身份凭证
+   -interactions-cache-size int         指定保存在交互缓存中的请求数（默认：5000）
+   -interactions-eviction int           从缓存中删除请求前等待的时间（默认为60秒）
+   -interactions-poll-duration int      每个轮询前等待时间（默认为5秒）
+   -interactions-cooldown-period int    退出轮询前的等待时间（默认为5秒）
+   -ni, -no-interactsh                  禁用反连检测平台，同时排除基于反连检测的模板
+
+限速：
+   -r1, -rate-limit int                 每秒最大请求量（默认：150）
+   -rlm, -rate-limit-minute int         每分钟最大请求量
+   -bs, -bulk-size int                  每个模板最大并行检测数（默认：25）
+   -c, -concurrency int                 并行执行的最大模板数量（默认：25）
+
+
+优化：
+   -timeout int                         超时时间（默认为5秒）
+   -retries int                         重试次数（默认：1）
+   -mhe, -max-host-error int            某主机扫描失败次数，跳过该主机（默认：30）
+   -project                             使用项目文件夹避免多次发送同一请求
+   -project-path string                 设置特定的项目文件夹
+   -spm, -stop-at-first-path            得到一个结果后停止（或许会中断模板和工作流的逻辑）
+   -stream                              流模式 - 在不整理输入的情况下详细描述
+
+无界面浏览器：
+    -headless                           启用需要无界面浏览器的模板
+    -page-timeout int                   在无界面下超时秒数（默认：20）
+    -sb, -show-brower                   在无界面浏览器运行模板时，显示浏览器
+    -sc, -system-chrome                 不使用Nuclei自带的浏览器，使用本地浏览器
+
+调试：
+    -debug                              显示所有请求和响应
+    -debug-req                          显示所有请求
+    -debug-resp                         显示所有响应
+    -proxy, -proxy-url string           使用HTTP代理
+    -proxy-socks-url string             使用SOCK5代理
+    -tlog, -trace-log string            写入请求日志到文件
+    -version                            显示版本信息
+    -v, -verbose                        显示详细信息
+    -vv                                 显示额外的详细信息
+    -tv, -templates-version             显示已安装的模板版本
+
+升级：
+    -update                             更新Nuclei到最新版本
+    -ut, -update-templates              更新Nuclei模板到最新版
+    -ud, -update-directory string       覆盖安装模板
+    -duc, -disable-update-check         禁用更新
+
+统计：
+    -stats                              显示正在扫描的统计信息
+    -sj, -stats-json                    将统计信息以JSONL格式输出到文件
+    -si, -stats-inerval int             显示统计信息更新的间隔秒数（默认：5）
+    -m, -metrics                        显示Nuclei端口信息
+    -mp, -metrics-port int              更改Nuclei默认端口（默认：9092）
+```
+
+### 运行Nuclei
+
+使用[社区提供的模板](https://github.com/projectdiscovery/nuclei-templates)扫描单个目标
 
 ```sh
-▶ nuclei -l urls.txt -t files/git-core.yaml -o results.txt
+nuclei -u https://example.com
 ```
 
-你可以轻松的通过管道使用标准的输入(STDIN)传递URL列表。
+使用[社区提供的模板](https://github.com/projectdiscovery/nuclei-templates)扫描多个目标
 
 ```sh
-▶ cat urls.txt | nuclei -t files/git-core.yaml -o results.txt
+nuclei -list urls.txt
 ```
 
-💡 Nuclei可以接受如下列表的URL作为输入，例如以下URL：
+Example of `urls.txt`:
 
-```
-https://test.some-site.com
-http://vuls-testing.com
-https://test.com
-```
-### 运行多个模板
-
-这将会对`urls.txt`中所有的URL运行`cves`和`files`模板检查，并返回输出到`results.txt`
-
-```sh
-▶ nuclei -l urls.txt -t cves/ -t files/ -o results.txt
+```yaml
+http://example.com
+http://app.example.com
+http://test.example.com
+http://uat.example.com
 ```
 
-### 使用subfinder运行
+**更多关于Nuclei的详细实例可以在[这里](https://nuclei.projectdiscovery.io/nuclei/get-started/#running-nuclei)找到**
 
-```sh
-▶ subfinder -d hackerone.com -silent | httpx -silent | nuclei -t cves/ -o results.txt
-```
+# 对于安全工程师
 
-### 在docker中运行
+Nuclei提供了大量有助于安全工程师在工作流定制相关的功能。通过各种扫描功能（如DNS、HTTP、TCP），安全工程师可以更轻松的使用Nuclei创建一套自定义的检查方式。
 
-你需要使用[nuclei的docker镜像](https://hub.docker.com/r/projectdiscovery/nuclei)来运行
+- 支持多种协议：TCP、DNS、HTTP、FILE等
+- 通过工作流和动态请求实现复杂的漏洞扫描
+- 易于集成到CI/CD，旨在可以轻松的集成到周期扫描中，以主动检测漏洞的修复和重新出现
 
-```sh
-▶ docker pull projectdiscovery/nuclei
-```
+<h1 align="left">
+  <a href="https://nuclei.projectdiscovery.io/nuclei/get-started/"><img src="static/learn-more-button.png" width="170px" alt="Learn More"></a>
+</h1>
 
-下载并构建完成后，运行以下命令：
+<table>
+<tr>
+<td>  
 
-```sh
-▶ docker run -it projectdiscovery/nuclei
-```
+**对于赏金猎人：**
 
-这将会对`urls.txt`中的URL通过docker中的nuclei进行检测，并将结果输出到本机的`results.txt`文件的：
+Nuclei允许您定制自己的测试方法，可以轻松的运行您的程序。此外Nuclei可以更容易的集成到您的漏扫设备中。
 
-```sh
-▶ cat urls.txt | docker run -v /path/to/nuclei-templates:/app/nuclei-templates -v /path/to/nuclei/config:/app/.nuclei-config.json -i projectdiscovery/nuclei -t /app/nuclei-templates/files/git-config.yaml > results.txt
-```
-记住更改的模板路径到本机
+- 可以集成到其他工作流中
+- 可以在几分钟处理上千台主机
+- 使用YAML语法定制自动化测试
 
-### 速率限制
+欢迎查看我们其他的开源项目，可能有适合您的赏金猎人工作流：[github.com/projectdiscovery](http://github.com/projectdiscovery)，我们还使用[Chaos绘制了每日的DNS数据](http://chaos.projectdiscovery.io)。
 
-Nuclei有多种控制速率的方法，包括并行执行多个模板、并行检查多个主机，以及使nuclei限制全局的请求速率，下面就是示例。
+</td>
+</tr>
+</table>
 
-- `-c`参数 => 限制并行的模板数
-- `-bulk-size`参数 => 限制并行的主机数
-- `-rate-limit`参数 => 全局速率限制
+<table>
+<tr>
+<td>
 
-如果你想快速扫描或者控制扫描，请使用这些标志并输入限制数，`速率限制`只保证控制传出的请求，与其他参数无关。
+**对于渗透测试：**
 
-### 排除模板
+Nuclei通过增加手动、自动的过程，极大地改变了安全评估的方式。一些公司已经在用Nuclei升级他们的手动测试步骤，可以使用Nulcei对数千台主机使用同样的流程自动化测试。
 
-[Nuclei模板](https://github.com/projectdiscovery/nuclei-templates)包含多种检查，其中有许多对攻击有用的检查，但并不是都有用的。如果您只希望扫描少数特定的模板或目录，则可以使用如下的参数筛选模板，或将某些模板排除。
+渗透测试员可以使用公共模板或者自定义模板来更快的完成渗透测试，特别是漏洞验证时，可以轻松的验证漏洞是否修复。
 
-#### 排除模板运行
+- 轻松根据您的要求创建标准清单（例如：OWASP TOP 10）
+- 通过[FUZZ](https://nuclei.projectdiscovery.io/templating-guide/#advance-fuzzing)和[工作流](https://nuclei.projectdiscovery.io/templating-guide/#workflows)等功能，可以使用Nuclei完成复杂的手动步骤和重复性渗透测试
+- 只需要重新运行Nuclei即可验证漏洞修复情况
 
-我们不建议同时运行所有的nuclei模板，如果要排除模板，可以使用`exclude`参数来排除特定的目录或模板。
+</td>
+</tr>
+</table>
 
-```sh
-nuclei -l urls.txt -t nuclei-templates -exclude panels/ -exclude technologies -exclude files/wp-xmlrpc.yaml
-```
+# 对于开发和组织
 
-注意：如上述示例中显示的那样，目录和特定模板都将不会扫描
+Nuclei构建很简单，通过数百名安全研究员的社区模板，Nuclei可以随时扫描来了解安全威胁。Nuclei通常用来用于复测，以确定漏洞是否被修复。
 
-#### 基于严重性运行模板
+- **CI/CD：**工程师已经支持了CI/CD，可以使用Nuclei来监控生产环境
+- **周期性扫描：**使用Nuclei创建新发现的漏洞模板，通过Nuclei可以周期性扫描消除漏洞
 
-您可以根据模板的严重性运行模板，扫描时可以选择单个严重性或多个严重性。
+我们有个[讨论组](https://github.com/projectdiscovery/nuclei-templates/discussions/693)，黑客提交自己的模板后可以获得赏金，这可以减少资产的漏洞，并且减少重复。如果你想实行该计划，可以[联系我](mailto:[email protected])。我们非常乐意提供帮助，或者在[讨论组](https://github.com/projectdiscovery/nuclei-templates/discussions/693)中发布相关信息。
 
-```sh
-nuclei -l urls.txt -t cves/ -severity critical,medium
-```
+<h3 align="center">
+  <img src="static/regression-with-nuclei.jpg" alt="regression-cycle-with-nuclei" width="1100px"></a>
+</h3>
 
-上面的例子将运行`cves`目录下所有`严重`和`中等`的模板。
+<h1 align="left">
+  <a href="https://github.com/projectdiscovery/nuclei-action"><img src="static/learn-more-button.png" width="170px" alt="Learn More"></a>
+</h1>
 
-```sh
-nuclei -l urls.txt -t panels/ -t technologies -severity info
-```
+### 资源
+- [使用Nuclei扫描](https://blog.projectdiscovery.io/community-powered-scanning-with-nuclei/)
+- [Nuclei Unleashed - 快速编写复杂漏洞](https://blog.projectdiscovery.io/nuclei-unleashed-quickly-write-complex-exploits/)
+- [Nuclei - FUZZ一切](https://blog.projectdiscovery.io/nuclei-fuzz-all-the-things/)
+- [Nuclei + Interactsh Integration，用于自动化OOB测试](https://blog.projectdiscovery.io/nuclei-interactsh-integration/)
+- [武器化Nuclei](https://medium.com/@dwisiswant0/weaponizes-nuclei-workflows-to-pwn-all-the-things-cd01223feb77) 作者：[@dwisiswant0](https://github.com/dwisiswant0)
+- [如何使用Nuclei连续扫描？](https://medium.com/@dwisiswant0/how-to-scan-continuously-with-nuclei-fcb7e9d8b8b9) 作者：[@dwisiswant0](https://github.com/dwisiswant0)
+- [自动化攻击](https://dhiyaneshgeek.github.io/web/security/2021/07/19/hack-with-automation/) 作者：[@DhiyaneshGeek](https://github.com/DhiyaneshGeek)
 
-上面的例子将运行`panels`和`technologies`目录下严重性标记为`info`的模板
+### 致谢
 
-#### 使用`.nuclei-ignore`文件排除模板
+感谢所有[社区贡献者提供的PR](https://github.com/projectdiscovery/nuclei/graphs/contributors)，另外您可以其他类似的开源项目：
 
-自从nuclei的[v2.1.1版本](https://github.com/projectdiscovery/nuclei/releases/tag/v2.1.1)以来，我们添加了对`.nuclei-ignore`文件的支持，该文件与`update-templates`参数一起使用，在 **.nuclei-ignore** 文件中，您可以定义要从nuclei扫描中排除的所有模板目录或者模板路径，要开始使用此功能，请确保使用`nuclei-update-templates`参数安装nuclei模板，现在可以根据`.nuclei-ignore`的文件来添加、更新、删除模板文件。
+[FFuF](https://github.com/ffuf/ffuf), [Qsfuzz](https://github.com/ameenmaali/qsfuzz), [Inception](https://github.com/proabiral/inception), [Snallygaster](https://github.com/hannob/snallygaster), [Gofingerprint](https://github.com/Static-Flow/gofingerprint), [Sn1per](https://github.com/1N3/Sn1per/tree/master/templates), [Google tsunami](https://github.com/google/tsunami-security-scanner), [Jaeles](https://github.com/jaeles-project/jaeles), [ChopChop](https://github.com/michelin/ChopChop)
 
-```
-nano ~/nuclei-templates/.nuclei-ignore
-```
+### 许可证
 
-默认的**nuclei忽略**列表可以访问[这里]((https://github.com/projectdiscovery/nuclei-templates/blob/master/.nuclei-ignore)，如果不想排除任何内容，只需要删除`.nuclei-ignore`文件。
+Nuclei使用[MIT许可证](https://github.com/projectdiscovery/nuclei/blob/master/LICENSE.md)
 
-* * *
-
-### 📋 笔记
-
-- 进度条是实验性功能，在某些情况下可能无法使用。
-- 进度条不适用于工作流，因为是条件执行，所以不准确。
-
-
-## 致谢
-
-也要看看这些类似的好项目，或许它们也适合你：
-
-[Burp Suite](https://portswigger.net/burp), [FFuF](https://github.com/ffuf/ffuf), [Jaeles](https://github.com/jaeles-project/jaeles), [Qsfuzz](https://github.com/ameenmaali/qsfuzz), [Inception](https://github.com/proabiral/inception), [Snallygaster](https://github.com/hannob/snallygaster), [Gofingerprint](https://github.com/Static-Flow/gofingerprint), [Sn1per](https://github.com/1N3/Sn1per/tree/master/templates), [Google tsunami](https://github.com/google/tsunami-security-scanner), [ChopChop](https://github.com/michelin/ChopChop)
-
---------
-
-Nuclei是由[projectdiscovery](https://projectdiscovery.io)团队用🖤制作的，当然社区也贡献了很多，通过 **[Thanks.md](https://github.com/projectdiscovery/nuclei/blob/master/THANKS.md)**文件以获取更多详细信息。
+<h1 align="left">
+  <a href="https://discord.gg/projectdiscovery"><img src="static/Join-Discord.png" width="380" alt="Join Discord"></a> <a href="https://nuclei.projectdiscovery.io"><img src="static/check-nuclei-documentation.png" width="380" alt="Check Nuclei Documentation"></a>
+</h1>

SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+DO NOT CREATE AN ISSUE to report a security problem. Instead, please send an email to security@projectdiscovery.io, and we will acknowledge it within 3 working days.

integration_tests/code/test.yaml

@@ -0,0 +1,17 @@
+id: go-integration-test
+
+info:
+  name: Basic Go Integration Test
+  author: pdteam
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    headers:
+      test: nuclei
+    matchers:
+      - type: word
+        words:
+          - "This is test headers matcher text"

integration_tests/dns/caa.yaml

@@ -0,0 +1,22 @@
+id: caa-fingerprinting
+
+info:
+  name: CAA Fingerprint
+  author: pdteam
+  severity: info
+  tags: dns,caa
+
+dns:
+  - name: "{{FQDN}}"
+    type: CAA
+
+    matchers:
+      - type: word
+        words:
+          - "IN\tCAA"
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "IN\tCAA\t(.+)"

integration_tests/dns/cname-fingerprint.yaml

@@ -0,0 +1,22 @@
+id: cname-fingerprint
+
+info:
+  name: CNAME Fingerprint
+  author: pdteam
+  severity: info
+  tags: dns,cname
+
+dns:
+  - name: "{{FQDN}}"
+    type: NS
+
+    matchers:
+      - type: word
+        words:
+          - "IN\tCNAME"
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "IN\tCNAME\t(.+)"

integration_tests/dns/ptr.yaml

@@ -0,0 +1,22 @@
+id: ptr-fingerprint
+
+info:
+  name: PTR Fingerprint
+  author: pdteam
+  severity: info
+  tags: dns,ptr
+
+dns:
+  - name: "{{FQDN}}"
+    type: PTR
+
+    matchers:
+      - type: word
+        words:
+          - "IN\tPTR"
+
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "IN\tPTR\t(.+)"

integration_tests/dns/variables.yaml

@@ -0,0 +1,20 @@
+id: variables-example
+
+info:
+  name: Variables Example
+  author: pdteam
+  severity: info
+
+variables:
+  a1: "IN"
+
+dns:
+  - name: "{{FQDN}}"
+    type: A
+    class: inet
+    recursion: true
+    retries: 3
+    matchers:
+      - type: word
+        words:
+          - "{{a1}}"

integration_tests/file/data/test1.txt

@@ -0,0 +1,2 @@
+AAA
+BBB

integration_tests/file/data/test2.txt

@@ -0,0 +1,2 @@
+CCC
+DDD

integration_tests/file/data/test3.txt

@@ -0,0 +1,2 @@
+11 EE 11
+11 FF 11

integration_tests/file/extract.yaml

@@ -0,0 +1,16 @@
+id: file-extract
+
+info:
+  name: File with Extractor
+  author: pdteam
+  severity: info
+  tags: file
+
+file:
+  - extensions:
+      - all
+
+    extractors:
+      - type: regex
+        regex:
+          - "(?m)11\\s(EE|FF)\\s11"

integration_tests/file/matcher-with-and.yaml

@@ -0,0 +1,20 @@
+id: file-matcher-with-or
+
+info:
+  name: File Matcher With AND
+  author: pdteam
+  severity: info
+  tags: file
+
+file:
+  - extensions:
+      - all
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "CCC"
+      - type: word
+        words:
+          - "DDD"

integration_tests/file/matcher-with-or.yaml

@@ -0,0 +1,19 @@
+id: file-matcher-with-or
+
+info:
+  name: File Matcher With OR
+  author: pdteam
+  severity: info
+  tags: file
+
+file:
+  - extensions:
+      - all
+
+    matchers:
+      - type: word
+        words:
+          - "AA"
+      - type: word
+        words:
+          - "BB"

integration_tests/headless/headless-basic.yaml

@@ -0,0 +1,18 @@
+id: headless-basic
+info:
+  name: Headless Basic
+  author: pdteam
+  severity: info
+  tags: headless
+
+headless:
+  - steps:
+      - action: navigate
+        args:
+          url: "{{BaseURL}}/"
+        
+      - action: waitload
+    matchers:
+      - type: word
+        words:
+          - "<html>"

integration_tests/headless/headless-extract-values.yaml

@@ -0,0 +1,31 @@
+
+id: headless-extract-values
+info:
+  name: Headless Extract Value
+  author: pdteam
+  severity: info
+  tags: headless
+
+headless:
+  - steps:
+      - action: navigate
+        args:
+          url: "{{BaseURL}}"        
+      - action: waitload
+      # From headless/extract-urls.yaml
+      - action: script
+        name: extract
+        args:
+          code: |
+            () => '\n' + [...new Set(Array.from(document.querySelectorAll('[src], [href], [url], [action]')).map(i => i.src || i.href || i.url || i.action))].join('\r\n') + '\n'
+
+    matchers:
+      - type: word
+        words:
+          - "test.html"
+    
+    extractors:
+      - type: kval
+        part: extract
+        kval:
+          - extract

integration_tests/headless/headless-header-action.yaml

@@ -0,0 +1,24 @@
+id: headless-header-action
+info:
+  name: Headless Header Action
+  author: pdteam
+  severity: info
+  tags: headless
+
+headless:
+  - steps:
+    - action: setheader
+      args:
+        part: request
+        key: Test
+        value: test value
+
+    - action: navigate
+      args:
+        url: "{{BaseURL}}/"
+        
+    - action: waitload
+    matchers:
+      - type: word
+        words:
+          - "test value"

integration_tests/headless/headless-payloads.yaml

@@ -0,0 +1,26 @@
+id: headless-payloads
+
+info:
+  name: headless payloads example
+  author: pdteam
+  severity: info
+  tags: headless
+
+headless:
+  - attack: clusterbomb
+    payloads:
+      aa:
+        - aa
+        - bb
+      bb:
+        - cc
+        - dd
+    steps:
+      - args:
+          url: "{{BaseURL}}?aa={{aa}}&bb={{bb}}"
+        action: navigate
+      - action: waitload
+    matchers:
+      - type: word
+        words:
+          - "test"

integration_tests/headless/variables.yaml

@@ -0,0 +1,20 @@
+id: variables-example
+
+info:
+  name: Variables Example
+  author: pdteam
+  severity: info
+
+variables:
+  a1: "{{base64('hello')}}"
+
+headless:
+  - steps:
+      - args:
+          url: "{{BaseURL}}"
+        action: navigate
+      - action: waitload
+    matchers:
+      - type: word
+        words:
+          - "{{a1}}"

integration_tests/http/disable-redirects.yaml

@@ -0,0 +1,17 @@
+id: basic-disable-redirects
+
+info:
+  name: Basic GET Redirects Request
+  author: pdteam
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    redirects: true
+    max-redirects: 2
+    matchers:
+      - type: word
+        words:
+          - "This is test disable redirects matcher text"

integration_tests/http/dsl-functions.yaml

@@ -0,0 +1,75 @@
+id: helper-functions-examples
+
+info:
+  name: RAW Template with Helper Functions
+  author: pdteam
+  severity: info
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        01: {{base64("Hello")}}
+        02: {{base64(1234)}}
+        03: {{base64_decode("SGVsbG8=")}}
+        04: {{base64_py("Hello")}}
+        05: {{concat("Hello", "world")}}
+        06: {{contains("Hello", "lo")}}
+        07: {{generate_java_gadget("commons-collections3.1", "wget http://{{interactsh-url}}", "base64")}}
+        08: {{gzip("Hello")}}
+        09: {{hex_decode("6161")}}
+        10: {{hex_encode("aa")}}
+        11: {{html_escape("<body>test</body>")}}
+        12: {{html_unescape("&lt;body&gt;test&lt;/body&gt;")}}
+        13: {{len("Hello")}}
+        14: {{len(5555)}}
+        15: {{md5("Hello")}}
+        16: {{md5(1234)}}
+        17: {{mmh3("Hello")}}
+        18: {{print_debug(1+2, "Hello")}}
+        19: {{rand_base(5, "abc")}}
+        20: {{rand_base(5, "")}}
+        21: {{rand_base(5)}}
+        22: {{rand_char("abc")}}
+        23: {{rand_char("")}}
+        24: {{rand_char()}}
+        25: {{rand_int(1, 10)}}
+        26: {{rand_int(10)}}
+        27: {{rand_int()}}
+        28: {{rand_ip("192.168.0.0/24")}}
+        29: {{rand_ip("2002:c0a8::/24")}}
+        30: {{rand_ip("192.168.0.0/24","10.0.100.0/24")}}
+        31: {{rand_text_alpha(10, "abc")}}
+        32: {{rand_text_alpha(10, "")}}
+        33: {{rand_text_alpha(10)}}
+        34: {{rand_text_alphanumeric(10, "ab12")}}
+        35: {{rand_text_alphanumeric(10)}}
+        36: {{rand_text_numeric(10, 123)}}
+        37: {{rand_text_numeric(10)}}
+        38: {{regex("H([a-z]+)o", "Hello")}}
+        39: {{remove_bad_chars("abcd", "bc")}}
+        40: {{repeat("a", 5)}}
+        41: {{replace("Hello", "He", "Ha")}}
+        42: {{replace_regex("He123llo", "(\\d+)", "")}}
+        43: {{reverse("abc")}}
+        44: {{sha1("Hello")}}
+        45: {{sha256("Hello")}}
+        46: {{to_lower("HELLO")}}
+        47: {{to_upper("hello")}}
+        48: {{trim("aaaHelloddd", "ad")}}
+        49: {{trim_left("aaaHelloddd", "ad")}}
+        50: {{trim_prefix("aaHelloaa", "aa")}}
+        51: {{trim_right("aaaHelloddd", "ad")}}
+        52: {{trim_space("  Hello  ")}}
+        53: {{trim_suffix("aaHelloaa", "aa")}}
+        54: {{unix_time(10)}}
+        55: {{url_decode("https:%2F%2Fprojectdiscovery.io%3Ftest=1")}}
+        56: {{url_encode("https://projectdiscovery.io/test?a=1")}}
+        57: {{wait_for(1)}}
+
+    extractors:
+      - type: regex
+        name: results
+        regex:
+          - '\d+: [^\s]+'

integration_tests/http/dsl-matcher-variable.yaml

@@ -0,0 +1,23 @@
+id: dsl-matcher-variable
+
+info:
+  name: dsl-matcher-variable
+  author: pd-team
+  severity: info
+
+requests: 
+  - 
+    path: 
+      - "{{BaseURL}}"
+    payloads: 
+      VALUES: 
+        - This
+        - is
+        - test
+        - matcher
+        - text
+    matchers: 
+      - 
+        dsl: 
+          - 'contains(body,"{{VALUES}}")'
+        type: dsl

integration_tests/http/get-case-insensitive.yaml

@@ -0,0 +1,16 @@
+id: basic-get-case-insensitive
+
+info:
+  name: Basic GET Request
+  author: pdteam
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    matchers:
+      - type: word
+        case-insensitive: true
+        words:
+          - "ThIS is TEsT MAtcHEr TExT"

integration_tests/http/get-override-sni.yaml

@@ -0,0 +1,18 @@
+id: basic-raw-http-example
+
+info:
+  name: Test RAW GET Template
+  author: pdteam
+  severity: info
+
+requests:
+  - raw:
+      - |
+        @tls-sni:request.host
+        GET / HTTP/1.1
+        Host: test
+
+    matchers:
+      - type: word
+        words:
+          - "test-ok"

integration_tests/http/get-redirects-chain-headers.yaml

@@ -0,0 +1,23 @@
+id: basic-get-redirects-chain-headers
+
+info:
+  name: Basic GET Redirects Request With Chain header
+  author: pdteam
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    redirects: true
+    max-redirects: 3
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "TestRedirectHeaderMatch"
+
+      - type: status
+        status:
+          - 302

integration_tests/http/get-sni-unsafe.yaml

@@ -0,0 +1,18 @@
+id: basic-unsafe-get
+
+info:
+  name: Basic Unsafe GET Request with CLI SNI
+  author: pdteam
+  severity: info
+
+requests:
+  - raw:
+      - |+
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    unsafe: true
+    matchers:
+      - type: word
+        words:
+          - "test-ok"

integration_tests/http/get-sni.yaml

@@ -0,0 +1,15 @@
+id: basic-get
+
+info:
+  name: Basic GET Request with CLI SNI
+  author: pdteam
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    matchers:
+      - type: word
+        words:
+          - "test-ok"

integration_tests/http/interactsh-stop-at-first-match.yaml

@@ -0,0 +1,23 @@
+id: interactsh-stop-at-first-match-integration-test
+
+info:
+  name: Interactsh StopAtFirstMatch Integration Test
+  author: pdteam
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+      - "{{BaseURL}}"
+      - "{{BaseURL}}"
+    headers:
+      url: 'http://{{interactsh-url}}'
+
+    stop-at-first-match: true
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
+        words:
+          - "http"

integration_tests/http/interactsh.yaml

@@ -0,0 +1,19 @@
+id: interactsh-integration-test
+
+info:
+  name: Interactsh Integration Test
+  author: pdteam
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    headers:
+      url: 'http://{{interactsh-url}}'
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
+        words:
+          - "http"

integration_tests/http/race-multiple.yaml

@@ -0,0 +1,46 @@
+id: race-condition-testing
+
+info:
+  name: Race condition testing with multiple requests
+  author: pdteam
+  severity: info
+
+requests:
+  - raw:  
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+        id=1
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+        id=2
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+        id=3
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+        id=4
+
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+        id=5
+
+    threads: 5
+    race: true
+
+    matchers:
+      - type: status
+        status:
+          - 200

integration_tests/http/race-simple.yaml

@@ -0,0 +1,23 @@
+id: race-condition-testing
+
+info:
+  name: Race Condition testing
+  author: pdteam
+  severity: info
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+        test      
+
+    race: true
+    race_count: 10
+
+    matchers:
+      - type: status
+        part: header
+        status:
+          - 200

integration_tests/http/raw-unsafe-request.yaml

@@ -7,7 +7,7 @@ info:
 
 requests:
   - raw:
-      - |
+      - |+
         GET / HTTP/1.1
         Host: 
         Content-Length: 4
@@ -17,4 +17,4 @@ requests:
     matchers:
       - type: word
         words:
-          - "This is test-raw-unsafe request matcher."
+          - "This is test raw-unsafe-matcher test"

integration_tests/http/redirect-match-url.yaml

@@ -0,0 +1,18 @@
+id: redirect-match-url
+
+info:
+  name: Redirect Match URL
+  author: pdteam
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    stop-at-first-match: true # Confirm stop-at-first-match
+    redirects: true # Confirm redirected URL matched value
+    max-redirects: 3
+    matchers:
+      - type: word
+        words:
+          - "This is test redirects matcher text"

integration_tests/http/self-contained.yaml

@@ -0,0 +1,18 @@
+id: example-self-contained-input
+
+info:
+  name: example-self-contained
+  author: pd-team
+  severity: info
+
+self-contained: true
+requests:
+  - raw:
+      - |
+        GET http://127.0.0.1:5431/ HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        words:
+          - This is self-contained response

integration_tests/http/stop-at-first-match-with-extractors.yaml

@@ -0,0 +1,18 @@
+id: stop-at-first-match-with-extractors
+
+info:
+  name: Stop at first match Request with extractors
+  author: pdteam
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}?a=1"
+      - "{{BaseURL}}?a=2"
+    stop-at-first-match: true
+    extractors:
+      - type: kval
+        part: header
+        kval:
+          - "date"

integration_tests/http/stop-at-first-match.yaml

@@ -0,0 +1,17 @@
+id: stop-at-first-match
+
+info:
+  name: Stop at first match Request
+  author: pdteam
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}?a=1"
+      - "{{BaseURL}}?a=2"
+    matchers:
+      - type: word
+        words:
+          - "This is test"
+    stop-at-first-match: true

integration_tests/http/variables.yaml

@@ -0,0 +1,26 @@
+id: variables-example
+
+info:
+  name: Variables Example
+  author: pdteam
+  severity: info
+
+variables:
+  a1: "value"
+  a2: "{{base64('hello')}}"
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{FQDN}}
+        Test: {{a1}}
+        Another: {{a2}}
+
+    stop-at-first-match: true
+    matchers-condition: or
+    matchers:
+      - type: word
+        words: 
+          - "value"
+          - "aGVsbG8="

integration_tests/loader/basic.yaml

@@ -0,0 +1,10 @@
+id: workflow-example
+
+info:
+  name: Test Workflow Template
+  author: pdteam
+  severity: info
+
+workflows:
+  - template: workflow/match-1.yaml
+  - template: workflow/match-2.yaml

integration_tests/loader/condition-matched.yaml

@@ -0,0 +1,11 @@
+id: condition-matched-workflow
+
+info:
+  name: Condition Matched Workflow
+  author: pdteam
+  severity: info
+
+workflows:
+  - template: workflow/match-1.yaml
+    subtemplates:
+      - template: workflow/match-2.yaml

integration_tests/loader/get-headers.yaml

@@ -0,0 +1,17 @@
+id: basic-get-headers
+
+info:
+  name: Basic GET Headers Request
+  author: pdteam
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    headers:
+      test: nuclei
+    matchers:
+      - type: word
+        words:
+          - "This is test headers matcher text"

integration_tests/loader/get.yaml

@@ -0,0 +1,15 @@
+id: basic-get
+
+info:
+  name: Basic GET Request
+  author: pdteam
+  severity: info
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    matchers:
+      - type: word
+        words:
+          - "This is test matcher text"

integration_tests/loader/template-list.yaml

@@ -0,0 +1,2 @@
+loader/get.yaml
+loader/get-headers.yaml

integration_tests/loader/workflow-list.yaml

@@ -0,0 +1,2 @@
+loader/basic.yaml
+loader/condition-matched.yaml

integration_tests/network/self-contained.yaml

@@ -0,0 +1,16 @@
+id: example-self-contained-input
+
+info:
+  name: example-self-contained
+  author: pd-team
+  severity: info
+
+self-contained: true
+network:
+  - host:
+      - "127.0.0.1:5431"
+
+    matchers:
+      - type: word
+        words:
+          - "Authentication successful"

integration_tests/network/variables.yaml

@@ -0,0 +1,22 @@
+id: variables-example
+
+info:
+  name: Variables Example
+  author: pdteam
+  severity: info
+
+variables:
+  a1: "PING"
+  a2: "{{base64('hello')}}"
+
+network:
+  - host: 
+      - "{{Hostname}}"
+    inputs:
+      - data: "{{a1}}"
+    read-size: 8
+    matchers:
+      - type: word
+        part: data
+        words:
+          - "{{a2}}"

integration_tests/run.sh

@@ -1,12 +1,23 @@
 #!/bin/bash
 
+echo "::group::Build nuclei"
+rm integration-test nuclei 2>/dev/null
 cd ../v2/cmd/nuclei
 go build
-cp nuclei ../../../integration_tests/nuclei 
+mv nuclei ../../../integration_tests/nuclei 
+echo "::endgroup::"
+
+echo "::group::Build nuclei integration-test"
 cd ../integration-test
 go build
-cp integration-test ../../../integration_tests/integration-test 
+mv integration-test ../../../integration_tests/integration-test 
 cd ../../../integration_tests
+echo "::endgroup::"
+
+echo "::group::Installing nuclei templates"
+./nuclei -update-templates
+echo "::endgroup::"
+
 ./integration-test
 if [ $? -eq 0 ]
 then

integration_tests/ssl/basic-ztls.yaml

@@ -0,0 +1,15 @@
+id: basic-ssl-tls
+
+info:
+  name:  Basic SSL Request with ztls
+  author: pdteam
+  severity: info
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+    min_version: sslv3
+    max_version: tls12
+    matchers:
+      - type: dsl
+        dsl:
+          - "not_after>=0"

integration_tests/ssl/basic.yaml

@@ -0,0 +1,13 @@
+id: expired-ssl
+
+info:
+  name: Basic SSL Request
+  author: pdteam
+  severity: info
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+    matchers:
+      - type: dsl
+        dsl:
+          - "not_after>=0"

integration_tests/ssl/custom-cipher.yaml

@@ -0,0 +1,16 @@
+id: expired-ssl
+
+info:
+  name: Basic SSL Request
+  author: pdteam
+  severity: info
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+    cipher_suites: 
+      - TLS_AES_128_GCM_SHA256
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "TLS_AES_128_GCM_SHA256"

integration_tests/ssl/custom-version.yaml

@@ -0,0 +1,16 @@
+id: expired-ssl
+
+info:
+  name: Basic SSL Request
+  author: pdteam
+  severity: info
+
+ssl:
+  - address: "{{Host}}:{{Port}}"
+    min_version: tls12
+    max_version: tls12
+    matchers:
+      - type: word
+        part: response
+        words:
+          - 'TLS12'

integration_tests/test-issue-tracker-config1.yaml

@@ -0,0 +1,68 @@
+allow-list:
+  severity: high, critical
+deny-list:
+  severity: low
+
+# GitHub contains configuration options for GitHub issue tracker
+github:
+  # base-url is the optional self-hosted GitHub application url
+  base-url: https://localhost:8443/github
+  # username is the username of the GitHub user
+  username: test-username
+  # owner is the owner name of the repository for issues
+  owner: test-owner
+  # token is the token for GitHub account
+  token: test-token
+  # project-name is the name of the repository
+  project-name: test-project
+  # issue-label is the label of the created issue type
+  issue-label: bug
+
+# GitLab contains configuration options for gitlab issue tracker
+gitlab:
+  # base-url is the optional self-hosted GitLab application url
+  base-url: https://localhost:8443/gitlab
+  # username is the username of the GitLab user
+  username: test-username
+  # token is the token for GitLab account
+  token: test-token
+  # project-name is the name/id of the project(repository)
+  project-name: "1234"
+  # issue-label is the label of the created issue type
+  issue-label: bug
+
+# Jira contains configuration options for Jira issue tracker
+jira:
+  # cloud is the boolean which tells if Jira instance is running in the cloud or on-prem version is used
+  cloud: true
+  # update-existing is the boolean which tells if the existing, opened issue should be updated or new one should be created
+  update-existing: false
+  # URL is the jira application url
+  url: https://localhost/jira
+  # account-id is the account-id of the Jira user or username in case of on-prem Jira
+  account-id: test-account-id
+  # email is the email of the user for Jira instance
+  email: [email protected]
+  # token is the token for Jira instance or password in case of on-prem Jira
+  token: test-token
+  # project-name is the name of the project.
+  project-name: test-project-name
+  # issue-type is the name of the created issue type
+  issue-type: bug
+
+# elasticsearch contains configuration options for elasticsearch exporter
+elasticsearch:
+  # IP for elasticsearch instance
+  ip: 127.0.0.1
+  # Port is the port of elasticsearch instance
+  port: 9200
+  # IndexName is the name of the elasticsearch index
+  index-name: nuclei
+  # SSL enables ssl for elasticsearch connection
+  ssl: false
+  # SSLVerification disables SSL verification for elasticsearch
+  ssl-verification: false
+  # Username for the elasticsearch instance
+  username: test
+  # Password is the password for elasticsearch instance
+  password: test

integration_tests/test-issue-tracker-config2.yaml

@@ -0,0 +1,70 @@
+allow-list:
+  severity:
+    - high
+    - critical
+deny-list:
+  severity: low
+
+# GitHub contains configuration options for GitHub issue tracker
+GitHub:
+  # base-url is the optional self-hosted GitHub application url
+  base-url: https://localhost:8443/GitHub
+  # username is the username of the GitHub user
+  username: test-username
+  # owner is the owner name of the repository for issues.
+  owner: test-owner
+  # token is the token for GitHub account.
+  token: test-token
+  # project-name is the name of the repository.
+  project-name: test-project
+  # issue-label is the label of the created issue type
+  issue-label: bug
+
+# GitLab contains configuration options for GitLab issue tracker
+GitLab:
+  # base-url is the optional self-hosted GitLab application url
+  base-url: https://localhost:8443/GitLab
+  # username is the username of the GitLab user
+  username: test-username
+  # token is the token for GitLab account.
+  token: test-token
+  # project-name is the name/id of the project(repository).
+  project-name: "1234"
+  # issue-label is the label of the created issue type
+  issue-label: bug
+
+# Jira contains configuration options for Jira issue tracker
+Jira:
+  # cloud is the boolean which tells if Jira instance is running in the cloud or on-prem version is used
+  cloud: true
+  # update-existing is the boolean which tells if the existing, opened issue should be updated or new one should be created
+  update-existing: false
+  # URL is the Jira application url
+  url: https://localhost/Jira
+  # account-id is the account-id of the Jira user or username in case of on-prem Jira
+  account-id: test-account-id
+  # email is the email of the user for Jira instance
+  email: [email protected]
+  # token is the token for Jira instance or password in case of on-prem Jira
+  token: test-token
+  # project-name is the name of the project.
+  project-name: test-project-name
+  # issue-type is the name of the created issue type
+  issue-type: bug
+
+# elasticsearch contains configuration options for elasticsearch exporter
+elasticsearch:
+  # IP for elasticsearch instance
+  ip: 127.0.0.1
+  # Port is the port of elasticsearch instance
+  port: 9200
+  # IndexName is the name of the elasticsearch index
+  index-name: nuclei
+  # SSL enables ssl for elasticsearch connection
+  ssl: false
+  # SSLVerification disables SSL verification for elasticsearch
+  ssl-verification: false
+  # Username for the elasticsearch instance
+  username: test
+  # Password is the password for elasticsearch instance
+  password: test

integration_tests/websocket/basic.yaml

@@ -0,0 +1,16 @@
+id: basic-request
+
+info:
+  name: Basic Request
+  author: pdteam
+  severity: info
+
+websocket:
+  - address: '{{Scheme}}://{{Hostname}}'
+    inputs:
+      - data: hello
+    matchers:
+      - type: word
+        words:
+          - world
+        part: response

integration_tests/websocket/cswsh.yaml

@@ -0,0 +1,16 @@
+id: basic-cswsh-request
+
+info:
+  name: Basic cswsh Request
+  author: pdteam
+  severity: info
+
+websocket:
+  - address: '{{Scheme}}://{{Hostname}}'
+    headers: 
+      Origin: 'http://evil.com'
+    matchers:
+      - type: word
+        words:
+          - true
+        part: success

integration_tests/websocket/no-cswsh.yaml

@@ -0,0 +1,16 @@
+id: basic-nocswsh-request
+
+info:
+  name: Basic Non-Vulnerable cswsh Request
+  author: pdteam
+  severity: info
+
+websocket:
+  - address: '{{Scheme}}://{{Hostname}}'
+    headers: 
+      Origin: 'http://evil.com'
+    matchers:
+      - type: word
+        words:
+          - true
+        part: success

integration_tests/websocket/path.yaml

@@ -0,0 +1,16 @@
+id: basic-request-path
+
+info:
+  name: Basic Request Path
+  author: pdteam
+  severity: info
+
+websocket:
+  - address: '{{Scheme}}://{{Hostname}}'
+    inputs:
+      - data: hello
+    matchers:
+      - type: word
+        words:
+          - world
+        part: response

integration_tests/whois/basic.yaml

@@ -0,0 +1,14 @@
+id: basic-whois-example
+
+info:
+  name: test template for WHOIS
+  author: pdteam
+  severity: info
+
+whois:
+  - query: "{{Host}}"
+    extractors:
+      - type: kval
+        kval:
+          - "expiration date"
+          - "registrar"

sonar-project.properties

@@ -0,0 +1,17 @@
+sonar.projectKey=projectdiscovery_nuclei
+sonar.organization=projectdiscovery
+
+# This is the name and version displayed in the SonarCloud UI.
+#sonar.projectName=dnsx
+#sonar.projectVersion=1.0
+
+# Path is relative to the sonar-project.properties file. Replace "\" by "/" on Windows.
+sonar.sources=v2/
+sonar.tests=v2/
+sonar.test.inclusions=**/*_test.go
+sonar.exclusions=v2/pkg/protocols/common/helpers/deserialization/testdata/*.java
+sonar.go.coverage.reportPaths=v2/cov.out
+sonar.externalIssuesReportPaths=v2/report.json
+
+# Encoding of the source code. Default is default system encoding
+#sonar.sourceEncoding=UTF-8

v2/.goreleaser.yml

@@ -3,23 +3,48 @@ before:
     - go mod tidy
 
 builds:
-    - binary: nuclei
-      main: cmd/nuclei/main.go
-      goos:
-        - linux
-        - windows
-        - darwin
-      goarch:
-        - amd64
-        - 386
-        - arm
-        - arm64
-  
+
+- main: cmd/nuclei/main.go
+  binary: nuclei
+  id: nuclei-cli
+
+  env:
+  - CGO_ENABLED=0
+
+  goos: [windows,linux,darwin]
+  goarch: [amd64,386,arm,arm64]
+  ignore:
+    - goos: darwin
+      goarch: 386
+    - goos: windows
+      goarch: arm
+    - goos: windows
+      goarch: arm64
+
+  flags:
+    - -trimpath
+
+- main: cmd/cve-annotate/main.go
+  binary: cve-annotate
+  id: annotate
+
+  env:
+  - CGO_ENABLED=0
+
+  goos: [linux]
+  goarch: [amd64]
+
 archives:
-    - id: tgz
-      format: tar.gz
-      replacements:
-          darwin: macOS
-      format_overrides:
-          - goos: windows
-            format: zip
+- format: zip
+  id: nuclei
+  builds: [nuclei-cli]
+  replacements:
+      darwin: macOS
+
+- format: zip
+  id: annotate
+  builds: [annotate]
+  name_template: "{{ .Binary }}"
+
+checksum:
+  algorithm: sha256

v2/Makefile

@@ -0,0 +1,32 @@
+# Go parameters
+GOCMD=go
+GOBUILD=$(GOCMD) build
+GOMOD=$(GOCMD) mod
+GOTEST=$(GOCMD) test
+GOFLAGS := -v
+# This should be disabled if the binary uses pprof
+LDFLAGS := -s -w
+
+ifneq ($(shell go env GOOS),darwin)
+LDFLAGS := -extldflags "-static"
+endif
+    
+all: build
+build:
+	$(GOBUILD) $(GOFLAGS) -ldflags '$(LDFLAGS)' -o "nuclei" cmd/nuclei/main.go
+docs:
+	if ! which dstdocgen > /dev/null; then
+		echo -e "Command not found! Install? (y/n) \c"
+		go get -v github.com/projectdiscovery/yamldoc-go/cmd/docgen/dstdocgen
+	fi
+	$(GOCMD) generate pkg/templates/templates.go
+	$(GOBUILD) -o "cmd/docgen/docgen" cmd/docgen/docgen.go
+	./cmd/docgen/docgen docs.md nuclei-jsonschema.json
+test:
+	$(GOTEST) $(GOFLAGS) ./...
+integration:
+	bash ../integration_tests/run.sh
+functional:
+	bash cmd/functional-tests/run.sh
+tidy:
+	$(GOMOD) tidy

v2/cmd/cve-annotate/main.go

@@ -0,0 +1,234 @@
+package main
+
+import (
+	"bytes"
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"os"
+	"regexp"
+	"strings"
+
+	"github.com/projectdiscovery/nvd"
+	"github.com/projectdiscovery/sliceutil"
+	"github.com/projectdiscovery/stringsutil"
+	"gopkg.in/yaml.v3"
+
+	"github.com/projectdiscovery/nuclei/v2/pkg/catalog"
+)
+
+const (
+	yamlIndentSpaces = 2
+)
+
+var (
+	input       = flag.String("i", "", "Templates to annotate")
+	templateDir = flag.String("d", "", "Custom template directory for update")
+)
+
+func main() {
+	flag.Parse()
+
+	if *input == "" || *templateDir == "" {
+		log.Fatalf("invalid input, see -h\n")
+	}
+
+	if err := process(); err != nil {
+		log.Fatalf("could not process: %s\n", err)
+	}
+}
+
+func process() error {
+	tempDir, err := ioutil.TempDir("", "nuclei-nvd-%s")
+	if err != nil {
+		return err
+	}
+	defer os.RemoveAll(tempDir)
+
+	client, err := nvd.NewClient(tempDir)
+	if err != nil {
+		return err
+	}
+	catalog := catalog.New(*templateDir)
+
+	paths, err := catalog.GetTemplatePath(*input)
+	if err != nil {
+		return err
+	}
+	for _, path := range paths {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		getCVEData(client, path, string(data))
+	}
+	return nil
+}
+
+var (
+	idRegex       = regexp.MustCompile("id: ([C|c][V|v][E|e]-[0-9]+-[0-9]+)")
+	severityRegex = regexp.MustCompile(`severity: ([a-z]+)`)
+)
+
+const maxReferenceCount = 5
+
+func getCVEData(client *nvd.Client, filePath, data string) {
+	matches := idRegex.FindAllStringSubmatch(data, 1)
+	if len(matches) == 0 {
+		return
+	}
+	cveName := matches[0][1]
+
+	severityMatches := severityRegex.FindAllStringSubmatch(data, 1)
+	if len(severityMatches) == 0 {
+		return
+	}
+	severityValue := severityMatches[0][1]
+
+	cveItem, err := client.FetchCVE(cveName)
+	if err != nil {
+		log.Printf("Could not fetch cve %s: %s\n", cveName, err)
+		return
+	}
+	var cweID []string
+	for _, problemData := range cveItem.CVE.Problemtype.ProblemtypeData {
+		for _, description := range problemData.Description {
+			cweID = append(cweID, description.Value)
+		}
+	}
+	cvssScore := cveItem.Impact.BaseMetricV3.CvssV3.BaseScore
+	cvssMetrics := cveItem.Impact.BaseMetricV3.CvssV3.VectorString
+
+	// Perform some hacky string replacement to place the metadata in templates
+	infoBlockIndexData := data[strings.Index(data, "info:"):]
+	requestsIndex := strings.Index(infoBlockIndexData, "requests:")
+	networkIndex := strings.Index(infoBlockIndexData, "network:")
+	variablesIndex := strings.Index(infoBlockIndexData, "variables:")
+	if requestsIndex == -1 && networkIndex == -1 && variablesIndex == -1 {
+		return
+	}
+	if networkIndex != -1 {
+		requestsIndex = networkIndex
+	}
+	if variablesIndex != -1 {
+		requestsIndex = variablesIndex
+	}
+	infoBlockData := infoBlockIndexData[:requestsIndex]
+	infoBlockClean := strings.TrimRight(infoBlockData, "\n")
+
+	infoBlock := InfoBlock{}
+	err = yaml.Unmarshal([]byte(data), &infoBlock)
+	if err != nil {
+		log.Printf("Could not unmarshal info block: %s\n", err)
+	}
+
+	var changed bool
+	if newSeverity := isSeverityMatchingCvssScore(severityValue, cvssScore); newSeverity != "" {
+		changed = true
+		infoBlock.Info.Severity = newSeverity
+		fmt.Printf("Adjusting severity for %s from %s=>%s (%.2f)\n", filePath, severityValue, newSeverity, cvssScore)
+	}
+	isCvssEmpty := cvssScore == 0 || cvssMetrics == ""
+	hasCvssChanged := infoBlock.Info.Classification.CvssScore != cvssScore || cvssMetrics != infoBlock.Info.Classification.CvssMetrics
+	if !isCvssEmpty && hasCvssChanged {
+		changed = true
+		infoBlock.Info.Classification.CvssMetrics = cvssMetrics
+		infoBlock.Info.Classification.CvssScore = cvssScore
+		infoBlock.Info.Classification.CveId = cveName
+		if len(cweID) > 0 && (cweID[0] != "NVD-CWE-Other" && cweID[0] != "NVD-CWE-noinfo") {
+			infoBlock.Info.Classification.CweId = strings.Join(cweID, ",")
+		}
+	}
+	// If there is no description field, fill the description from CVE information
+	hasDescriptionData := len(cveItem.CVE.Description.DescriptionData) > 0
+	isDescriptionEmpty := infoBlock.Info.Description == ""
+	if isDescriptionEmpty && hasDescriptionData {
+		changed = true
+		// removes all new lines
+		description := stringsutil.ReplaceAny(cveItem.CVE.Description.DescriptionData[0].Value, "", "\n", "\\", "'", "\t")
+		description += "\n"
+		infoBlock.Info.Description = description
+	}
+
+	// we are unmarshaling info block to have valid data
+	var referenceDataURLs []string
+	for _, reference := range cveItem.CVE.References.ReferenceData {
+		referenceDataURLs = append(referenceDataURLs, reference.URL)
+	}
+	hasReferenceData := len(cveItem.CVE.References.ReferenceData) > 0
+	areCveReferencesContained := sliceutil.ContainsItems(infoBlock.Info.Reference, referenceDataURLs)
+	referencesCount := len(infoBlock.Info.Reference)
+	if hasReferenceData && !areCveReferencesContained {
+		changed = true
+		for _, reference := range cveItem.CVE.References.ReferenceData {
+			referencesCount++
+			if referencesCount >= maxReferenceCount {
+				break
+			}
+			infoBlock.Info.Reference = append(infoBlock.Info.Reference, reference.URL)
+		}
+		infoBlock.Info.Reference = sliceutil.PruneEmptyStrings(sliceutil.Dedupe(infoBlock.Info.Reference))
+	}
+
+	var newInfoBlock bytes.Buffer
+	yamlEncoder := yaml.NewEncoder(&newInfoBlock)
+	yamlEncoder.SetIndent(yamlIndentSpaces)
+	err = yamlEncoder.Encode(infoBlock)
+	if err != nil {
+		log.Printf("Could not marshal info block: %s\n", err)
+		return
+	}
+	newInfoBlockData := strings.TrimSuffix(newInfoBlock.String(), "\n")
+
+	newTemplate := strings.ReplaceAll(data, infoBlockClean, newInfoBlockData)
+	if changed {
+		_ = ioutil.WriteFile(filePath, []byte(newTemplate), 0644)
+		fmt.Printf("Wrote updated template to %s\n", filePath)
+	}
+}
+
+func isSeverityMatchingCvssScore(severity string, score float64) string {
+	if score == 0.0 {
+		return ""
+	}
+	var expected string
+
+	if score >= 0.1 && score <= 3.9 {
+		expected = "low"
+	} else if score >= 4.0 && score <= 6.9 {
+		expected = "medium"
+	} else if score >= 7.0 && score <= 8.9 {
+		expected = "high"
+	} else if score >= 9.0 && score <= 10.0 {
+		expected = "critical"
+	}
+	if expected != "" && expected != severity {
+		return expected
+	}
+	return ""
+}
+
+// Cloning struct from nuclei as we don't want any validation
+type InfoBlock struct {
+	Info TemplateInfo `yaml:"info"`
+}
+
+type TemplateClassification struct {
+	CvssMetrics string  `yaml:"cvss-metrics,omitempty"`
+	CvssScore   float64 `yaml:"cvss-score,omitempty"`
+	CveId       string  `yaml:"cve-id,omitempty"`
+	CweId       string  `yaml:"cwe-id,omitempty"`
+}
+
+type TemplateInfo struct {
+	Name           string                 `yaml:"name"`
+	Author         string                 `yaml:"author"`
+	Severity       string                 `yaml:"severity"`
+	Description    string                 `yaml:"description,omitempty"`
+	Reference      []string               `yaml:"reference,omitempty"`
+	Remediation    string                 `yaml:"remediation,omitempty"`
+	Classification TemplateClassification `yaml:"classification,omitempty"`
+	Metadata       map[string]string      `yaml:"metadata,omitempty"`
+	Tags           string                 `yaml:"tags,omitempty"`
+}

v2/cmd/docgen/docgen.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"io/ioutil"
+	"log"
+	"os"
+	"regexp"
+	"strings"
+
+	"github.com/alecthomas/jsonschema"
+
+	"github.com/projectdiscovery/nuclei/v2/pkg/templates"
+)
+
+var pathRegex = regexp.MustCompile(`github\.com/projectdiscovery/nuclei/v2/(?:internal|pkg)/(?:.*/)?([A-Za-z.]+)`)
+
+func main() {
+	// Generate yaml syntax documentation
+	data, err := templates.GetTemplateDoc().Encode()
+	if err != nil {
+		log.Fatalf("Could not encode docs: %s\n", err)
+	}
+	err = ioutil.WriteFile(os.Args[1], data, 0644)
+	if err != nil {
+		log.Fatalf("Could not write docs: %s\n", err)
+	}
+
+	// Generate jsonschema
+	r := &jsonschema.Reflector{
+		PreferYAMLSchema:      true,
+		YAMLEmbeddedStructs:   true,
+		FullyQualifyTypeNames: true,
+	}
+	jsonschemaData := r.Reflect(&templates.Template{})
+
+	var buf bytes.Buffer
+	encoder := json.NewEncoder(&buf)
+	encoder.SetIndent("", "  ")
+	_ = encoder.Encode(jsonschemaData)
+
+	schema := buf.String()
+	for _, match := range pathRegex.FindAllStringSubmatch(schema, -1) {
+		schema = strings.ReplaceAll(schema, match[0], match[1])
+	}
+	err = ioutil.WriteFile(os.Args[2], []byte(schema), 0644)
+	if err != nil {
+		log.Fatalf("Could not write jsonschema: %s\n", err)
+	}
+}

v2/cmd/functional-test/main.go

@@ -0,0 +1,106 @@
+package main
+
+import (
+	"bufio"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"strings"
+
+	"github.com/logrusorgru/aurora"
+	"github.com/pkg/errors"
+
+	"github.com/projectdiscovery/nuclei/v2/pkg/testutils"
+)
+
+var (
+	success      = aurora.Green("[✓]").String()
+	failed       = aurora.Red("[✘]").String()
+	githubAction = os.Getenv("GH_ACTION") == "true"
+
+	mainNucleiBinary = flag.String("main", "", "Main Branch Nuclei Binary")
+	devNucleiBinary  = flag.String("dev", "", "Dev Branch Nuclei Binary")
+	testcases        = flag.String("testcases", "", "Test cases file for nuclei functional tests")
+)
+
+func main() {
+	flag.Parse()
+
+	debug := os.Getenv("DEBUG") == "true"
+
+	if err, errored := runFunctionalTests(debug); err != nil {
+		log.Fatalf("Could not run functional tests: %s\n", err)
+	} else if errored {
+		os.Exit(1)
+	}
+}
+
+func runFunctionalTests(debug bool) (error, bool) {
+	file, err := os.Open(*testcases)
+	if err != nil {
+		return errors.Wrap(err, "could not open test cases"), true
+	}
+	defer file.Close()
+
+	errored, failedTestCases := runTestCases(file, debug)
+
+	if githubAction {
+		fmt.Println("::group::Failed tests with debug")
+		for _, failedTestCase := range failedTestCases {
+			_ = runTestCase(failedTestCase, true)
+		}
+		fmt.Println("::endgroup::")
+	}
+
+	return nil, errored
+}
+
+func runTestCases(file *os.File, debug bool) (bool, []string) {
+	errored := false
+	var failedTestCases []string
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		testCase := strings.TrimSpace(scanner.Text())
+		if testCase == "" {
+			continue
+		}
+		if runTestCase(testCase, debug) {
+			errored = true
+			failedTestCases = append(failedTestCases, testCase)
+		}
+	}
+	return errored, failedTestCases
+}
+
+func runTestCase(testCase string, debug bool) bool {
+	if err := runIndividualTestCase(testCase, debug); err != nil {
+		fmt.Fprintf(os.Stderr, "%s Test \"%s\" failed: %s\n", failed, testCase, err)
+		return true
+	} else {
+		fmt.Printf("%s Test \"%s\" passed!\n", success, testCase)
+	}
+	return false
+}
+
+func runIndividualTestCase(testcase string, debug bool) error {
+	parts := strings.Fields(testcase)
+
+	var finalArgs []string
+	if len(parts) > 1 {
+		finalArgs = parts[1:]
+	}
+	mainOutput, err := testutils.RunNucleiBinaryAndGetLoadedTemplates(*mainNucleiBinary, debug, finalArgs)
+	if err != nil {
+		return errors.Wrap(err, "could not run nuclei main test")
+	}
+	devOutput, err := testutils.RunNucleiBinaryAndGetLoadedTemplates(*devNucleiBinary, debug, finalArgs)
+	if err != nil {
+		return errors.Wrap(err, "could not run nuclei dev test")
+	}
+	if mainOutput == devOutput {
+		return nil
+	}
+	return fmt.Errorf("%s main is not equal to %s dev", mainOutput, devOutput)
+}

v2/cmd/functional-test/run.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# reading os type from arguments
+CURRENT_OS=$1
+
+if [ "${CURRENT_OS}" == "windows-latest" ];then
+    extension=.exe
+fi
+
+echo "::group::Building functional-test binary"
+go build -o functional-test$extension
+echo "::endgroup::"
+
+echo "::group::Building Nuclei binary from current branch"
+go build -o nuclei_dev$extension ../nuclei
+echo "::endgroup::"
+
+echo "::group::Installing nuclei templates"
+./nuclei_dev$extension -update-templates
+echo "::endgroup::"
+
+echo "::group::Building latest release of nuclei"
+go build -o nuclei$extension -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei
+echo "::endgroup::"
+
+echo 'Starting Nuclei functional test'
+./functional-test$extension -main ./nuclei$extension -dev ./nuclei_dev$extension -testcases testcases.txt

v2/cmd/functional-test/testcases.txt

@@ -0,0 +1,51 @@
+{{binary}}
+{{binary}} -tags cve
+{{binary}} -tags cve,exposure
+{{binary}} -tags cve,exposure -tags token
+{{binary}} -tags cve,exposure -tags token,logs
+{{binary}} -tags "cve","exposure" -tags "token","logs"
+{{binary}} -tags 'cve','exposure' -tags 'token','logs'
+{{binary}} -tags cve -severity high
+{{binary}} -tags cve,exposure -severity high,critical
+{{binary}} -tags cve,exposure -severity high,critical,medium
+{{binary}} -tags cve -author geeknik
+{{binary}} -tags cve -author geeknik,pdteam
+{{binary}} -tags cve -author geeknik -severity high
+{{binary}} -tags cve
+{{binary}} -tags cve,exposure
+{{binary}} -tags cve,exposure -tags token
+{{binary}} -tags cve,exposure -tags token,logs
+{{binary}} -tags "cve","exposure" -tags "token","logs"
+{{binary}} -tags 'cve','exposure' -tags 'token','logs'
+{{binary}} -tags cve -severity high
+{{binary}} -tags cve,exposure -severity high,critical
+{{binary}} -tags cve,exposure -severity high,critical,medium
+{{binary}} -tags cve -author geeknik
+{{binary}} -tags cve -author geeknik,pdteam
+{{binary}} -tags cve -author geeknik -severity high
+{{binary}} -tags cve,exposure -author geeknik,pdteam -severity high,critical
+{{binary}} -tags "cve,exposure" -author "geeknik,pdteam" -severity high,critical
+{{binary}} -tags cve -etags ssrf
+{{binary}} -tags cve,exposure -etags ssrf,config
+{{binary}} -tags cve,exposure -etags ssrf,config -severity high
+{{binary}} -tags cve,exposure -etags ssrf,config -severity high -author geeknik
+{{binary}} -tags cve,dos,fuzz
+{{binary}} -tags cve -include-tags dos,fuzz
+{{binary}} -tags cve -exclude-tags cve2020
+{{binary}} -tags cve -exclude-templates cves/2020/
+{{binary}} -tags cve -exclude-templates cves/2020/CVE-2020-9757.yaml
+{{binary}} -tags cve -exclude-templates cves/2020/CVE-2020-9757.yaml -exclude-templates cves/2021/
+{{binary}} -t cves/
+{{binary}} -t cves/ -t exposures/
+{{binary}} -t cves/ -t exposures/ -tags config
+{{binary}} -t cves/ -t exposures/ -tags config,ssrf
+{{binary}} -t cves/ -t exposures/ -tags config -severity high,critical
+{{binary}} -t cves/ -t exposures/ -tags config -severity high,critical -author geeknik,pdteam
+{{binary}} -t cves/ -t exposures/ -tags config -severity high,critical -author geeknik,pdteam -etags sqli
+{{binary}} -t cves/ -t exposures/ -tags config -severity high,critical -author geeknik,pdteam -etags sqli -exclude-templates cves/2021/
+{{binary}} -t cves/ -t exposures/ -tags config -severity high,critical -author geeknik,pdteam -etags sqli -exclude-templates cves/2017/CVE-2017-7269.yaml
+{{binary}} -t cves/ -t exposures/ -tags config -severity high,critical -author geeknik,pdteam -etags sqli -include-templates cves/2017/CVE-2017-7269.yaml
+{{binary}} -w workflows
+{{binary}} -w workflows -author geeknik,pdteam
+{{binary}} -w workflows -severity high,critical
+{{binary}} -w workflows -author geeknik,pdteam  -severity high,critical

v2/cmd/integration-test/code.go

@@ -0,0 +1,129 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path"
+	"strings"
+
+	"github.com/julienschmidt/httprouter"
+	"github.com/logrusorgru/aurora"
+	"github.com/pkg/errors"
+	"github.com/projectdiscovery/goflags"
+	"github.com/projectdiscovery/nuclei/v2/pkg/catalog"
+	"github.com/projectdiscovery/nuclei/v2/pkg/catalog/config"
+	"github.com/projectdiscovery/nuclei/v2/pkg/catalog/loader"
+	"github.com/projectdiscovery/nuclei/v2/pkg/core"
+	"github.com/projectdiscovery/nuclei/v2/pkg/core/inputs"
+	"github.com/projectdiscovery/nuclei/v2/pkg/output"
+	"github.com/projectdiscovery/nuclei/v2/pkg/parsers"
+	"github.com/projectdiscovery/nuclei/v2/pkg/protocols"
+	"github.com/projectdiscovery/nuclei/v2/pkg/protocols/common/hosterrorscache"
+	"github.com/projectdiscovery/nuclei/v2/pkg/protocols/common/interactsh"
+	"github.com/projectdiscovery/nuclei/v2/pkg/protocols/common/protocolinit"
+	"github.com/projectdiscovery/nuclei/v2/pkg/protocols/common/protocolstate"
+	"github.com/projectdiscovery/nuclei/v2/pkg/reporting"
+	"github.com/projectdiscovery/nuclei/v2/pkg/testutils"
+	"github.com/projectdiscovery/nuclei/v2/pkg/types"
+	"go.uber.org/ratelimit"
+)
+
+var codeTestcases = map[string]testutils.TestCase{
+	"code/test.yaml": &goIntegrationTest{},
+}
+
+type goIntegrationTest struct{}
+
+// Execute executes a test case and returns an error if occurred
+//
+// Execute the docs at ../DESIGN.md if the code stops working for integration.
+func (h *goIntegrationTest) Execute(templatePath string) error {
+	router := httprouter.New()
+
+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		fmt.Fprintf(w, "This is test matcher text")
+		if strings.EqualFold(r.Header.Get("test"), "nuclei") {
+			fmt.Fprintf(w, "This is test headers matcher text")
+		}
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	results, err := executeNucleiAsCode(templatePath, ts.URL)
+	if err != nil {
+		return err
+	}
+	return expectResultsCount(results, 1)
+}
+
+// executeNucleiAsCode contains an example
+func executeNucleiAsCode(templatePath, templateURL string) ([]string, error) {
+	cache := hosterrorscache.New(30, hosterrorscache.DefaultMaxHostsCount)
+	defer cache.Close()
+
+	mockProgress := &testutils.MockProgressClient{}
+	reportingClient, _ := reporting.New(&reporting.Options{}, "")
+	defer reportingClient.Close()
+
+	outputWriter := testutils.NewMockOutputWriter()
+	var results []string
+	outputWriter.WriteCallback = func(event *output.ResultEvent) {
+		results = append(results, fmt.Sprintf("%v\n", event))
+	}
+
+	defaultOpts := types.DefaultOptions()
+	_ = protocolstate.Init(defaultOpts)
+	_ = protocolinit.Init(defaultOpts)
+
+	defaultOpts.Templates = goflags.FileOriginalNormalizedStringSlice{templatePath}
+	defaultOpts.ExcludeTags = config.ReadIgnoreFile().Tags
+
+	interactOpts := interactsh.NewDefaultOptions(outputWriter, reportingClient, mockProgress)
+	interactClient, err := interactsh.New(interactOpts)
+	if err != nil {
+		return nil, errors.Wrap(err, "could not create interact client")
+	}
+	defer interactClient.Close()
+
+	home, _ := os.UserHomeDir()
+	catalog := catalog.New(path.Join(home, "nuclei-templates"))
+	executerOpts := protocols.ExecuterOptions{
+		Output:          outputWriter,
+		Options:         defaultOpts,
+		Progress:        mockProgress,
+		Catalog:         catalog,
+		IssuesClient:    reportingClient,
+		RateLimiter:     ratelimit.New(150),
+		Interactsh:      interactClient,
+		HostErrorsCache: cache,
+		Colorizer:       aurora.NewAurora(true),
+		ResumeCfg:       types.NewResumeCfg(),
+	}
+	engine := core.New(defaultOpts)
+	engine.SetExecuterOptions(executerOpts)
+
+	workflowLoader, err := parsers.NewLoader(&executerOpts)
+	if err != nil {
+		log.Fatalf("Could not create workflow loader: %s\n", err)
+	}
+	executerOpts.WorkflowLoader = workflowLoader
+
+	configObject, err := config.ReadConfiguration()
+	if err != nil {
+		return nil, errors.Wrap(err, "could not read configuration file")
+	}
+	store, err := loader.New(loader.NewConfig(defaultOpts, configObject, catalog, executerOpts))
+	if err != nil {
+		return nil, errors.Wrap(err, "could not create loader")
+	}
+	store.Load()
+
+	input := &inputs.SimpleInputProvider{Inputs: []string{templateURL}}
+	_ = engine.Execute(store.Templates(), input)
+	engine.WorkPool().Wait() // Wait for the scan to finish
+
+	return results, nil
+}

v2/cmd/integration-test/dns.go

@@ -1,28 +1,76 @@
 package main
 
 import (
-	"github.com/projectdiscovery/nuclei/v2/internal/testutils"
+	"github.com/projectdiscovery/nuclei/v2/pkg/testutils"
 )
 
 var dnsTestCases = map[string]testutils.TestCase{
-	"dns/basic.yaml": &dnsBasic{},
+	"dns/basic.yaml":     &dnsBasic{},
+	"dns/ptr.yaml":       &dnsPtr{},
+	"dns/caa.yaml":       &dnsCAA{},
+	"dns/variables.yaml": &dnsVariables{},
 }
 
 type dnsBasic struct{}
 
-// Executes executes a test case and returns an error if occurred
+// Execute executes a test case and returns an error if occurred
 func (h *dnsBasic) Execute(filePath string) error {
 	var routerErr error
 
-	results, err := testutils.RunNucleiAndGetResults(filePath, "one.one.one.one", debug)
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, "one.one.one.one", debug)
 	if err != nil {
 		return err
 	}
 	if routerErr != nil {
 		return routerErr
 	}
-	if len(results) != 1 {
-		return errIncorrectResultsCount(results)
+	return expectResultsCount(results, 1)
+}
+
+type dnsPtr struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *dnsPtr) Execute(filePath string) error {
+	var routerErr error
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, "1.1.1.1", debug)
+	if err != nil {
+		return err
 	}
-	return nil
+	if routerErr != nil {
+		return routerErr
+	}
+	return expectResultsCount(results, 1)
+}
+
+type dnsCAA struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *dnsCAA) Execute(filePath string) error {
+	var routerErr error
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, "google.com", debug)
+	if err != nil {
+		return err
+	}
+	if routerErr != nil {
+		return routerErr
+	}
+	return expectResultsCount(results, 1)
+}
+
+type dnsVariables struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *dnsVariables) Execute(filePath string) error {
+	var routerErr error
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, "one.one.one.one", debug)
+	if err != nil {
+		return err
+	}
+	if routerErr != nil {
+		return routerErr
+	}
+	return expectResultsCount(results, 1)
 }

v2/cmd/integration-test/file.go

@@ -0,0 +1,47 @@
+package main
+
+import (
+	"github.com/projectdiscovery/nuclei/v2/pkg/testutils"
+)
+
+var fileTestcases = map[string]testutils.TestCase{
+	"file/matcher-with-or.yaml":  &fileWithOrMatcher{},
+	"file/matcher-with-and.yaml": &fileWithAndMatcher{},
+	"file/extract.yaml":          &fileWithExtractor{},
+}
+
+type fileWithOrMatcher struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *fileWithOrMatcher) Execute(filePath string) error {
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, "file/data/", debug)
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 1)
+}
+
+type fileWithAndMatcher struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *fileWithAndMatcher) Execute(filePath string) error {
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, "file/data/", debug)
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 1)
+}
+
+type fileWithExtractor struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *fileWithExtractor) Execute(filePath string) error {
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, "file/data/", debug)
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 1)
+}

v2/cmd/integration-test/headless.go

@@ -0,0 +1,113 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+
+	"github.com/julienschmidt/httprouter"
+
+	"github.com/projectdiscovery/nuclei/v2/pkg/testutils"
+)
+
+var headlessTestcases = map[string]testutils.TestCase{
+	"headless/headless-basic.yaml":          &headlessBasic{},
+	"headless/headless-header-action.yaml":  &headlessHeaderActions{},
+	"headless/headless-extract-values.yaml": &headlessExtractValues{},
+	"headless/headless-payloads.yaml":       &headlessPayloads{},
+	"headless/variables.yaml":               &headlessVariables{},
+}
+
+type headlessBasic struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *headlessBasic) Execute(filePath string) error {
+	router := httprouter.New()
+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		_, _ = w.Write([]byte("<html><body></body></html>"))
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug, "-headless")
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 1)
+}
+
+type headlessHeaderActions struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *headlessHeaderActions) Execute(filePath string) error {
+	router := httprouter.New()
+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		testValue := r.Header.Get("test")
+		if r.Header.Get("test") != "" {
+			_, _ = w.Write([]byte("<html><body>" + testValue + "</body></html>"))
+		}
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug, "-headless")
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 1)
+}
+
+type headlessExtractValues struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *headlessExtractValues) Execute(filePath string) error {
+	router := httprouter.New()
+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		_, _ = w.Write([]byte("<html><body><a href='/test.html'>test</a></body></html>"))
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug, "-headless")
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 3)
+}
+
+type headlessPayloads struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *headlessPayloads) Execute(filePath string) error {
+	router := httprouter.New()
+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		_, _ = w.Write([]byte("<html><body>test</body></html>"))
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug, "-headless")
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 4)
+}
+
+type headlessVariables struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *headlessVariables) Execute(filePath string) error {
+	router := httprouter.New()
+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		_, _ = w.Write([]byte("<html><body>aGVsbG8=</body></html>"))
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug, "-headless")
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 1)
+}

v2/cmd/integration-test/integration-test.go

@@ -6,45 +6,106 @@ import (
 	"strings"
 
 	"github.com/logrusorgru/aurora"
-	"github.com/projectdiscovery/nuclei/v2/internal/testutils"
+
+	"github.com/projectdiscovery/nuclei/v2/pkg/testutils"
 )
 
 var (
-	debug      = os.Getenv("DEBUG") == "true"
-	customTest = os.Getenv("TEST")
-	protocol   = os.Getenv("PROTO")
+	debug        = os.Getenv("DEBUG") == "true"
+	githubAction = os.Getenv("GH_ACTION") == "true"
+	customTests  = os.Getenv("TESTS")
+
+	success = aurora.Green("[✓]").String()
+	failed  = aurora.Red("[✘]").String()
+
+	protocolTests = map[string]map[string]testutils.TestCase{
+		"http":          httpTestcases,
+		"network":       networkTestcases,
+		"dns":           dnsTestCases,
+		"workflow":      workflowTestcases,
+		"loader":        loaderTestcases,
+		"websocket":     websocketTestCases,
+		"headless":      headlessTestcases,
+		"whois":         whoisTestCases,
+		"ssl":           sslTestcases,
+		"code":          codeTestcases,
+		"templatesPath": templatesPathTestCases,
+		"templatesDir":  templatesDirTestCases,
+		"file":          fileTestcases,
+	}
 )
 
 func main() {
-	success := aurora.Green("[✓]").String()
-	failed := aurora.Red("[✘]").String()
+	failedTestTemplatePaths := runTests(toMap(toSlice(customTests)))
 
-	protocolTests := map[string]map[string]testutils.TestCase{
-		"http":     httpTestcases,
-		"network":  networkTestcases,
-		"dns":      dnsTestCases,
-		"workflow": workflowTestcases,
+	if len(failedTestTemplatePaths) > 0 {
+		if githubAction {
+			debug = true
+			fmt.Println("::group::Failed integration tests in debug mode")
+			_ = runTests(failedTestTemplatePaths)
+			fmt.Println("::endgroup::")
+		}
+
+		os.Exit(1)
 	}
-	for proto, tests := range protocolTests {
-		if protocol == "" || protocol == proto {
-			fmt.Printf("Running test cases for \"%s\" protocol\n", aurora.Blue(proto))
+}
 
-			for file, test := range tests {
-				if customTest != "" && !strings.Contains(file, customTest) {
-					continue // only run tests user asked
-				}
-				err := test.Execute(file)
-				if err != nil {
-					fmt.Fprintf(os.Stderr, "%s Test \"%s\" failed: %s\n", failed, file, err)
-					os.Exit(1)
-				} else {
-					fmt.Printf("%s Test \"%s\" passed!\n", success, file)
+func runTests(customTemplatePaths map[string]struct{}) map[string]struct{} {
+	failedTestTemplatePaths := map[string]struct{}{}
+
+	for proto, testCases := range protocolTests {
+		if len(customTemplatePaths) == 0 {
+			fmt.Printf("Running test cases for %q protocol\n", aurora.Blue(proto))
+		}
+
+		for templatePath, testCase := range testCases {
+			if len(customTemplatePaths) == 0 || contains(customTemplatePaths, templatePath) {
+				if err, failedTemplatePath := execute(testCase, templatePath); err != nil {
+					failedTestTemplatePaths[failedTemplatePath] = struct{}{}
 				}
 			}
 		}
 	}
+
+	return failedTestTemplatePaths
 }
 
-func errIncorrectResultsCount(results []string) error {
-	return fmt.Errorf("incorrect number of results %s", strings.Join(results, "\n\t"))
+func execute(testCase testutils.TestCase, templatePath string) (error, string) {
+	if err := testCase.Execute(templatePath); err != nil {
+		_, _ = fmt.Fprintf(os.Stderr, "%s Test \"%s\" failed: %s\n", failed, templatePath, err)
+		return err, templatePath
+	}
+
+	fmt.Printf("%s Test \"%s\" passed!\n", success, templatePath)
+	return nil, ""
+}
+
+func expectResultsCount(results []string, expectedNumber int) error {
+	if len(results) != expectedNumber {
+		return fmt.Errorf("incorrect number of results: %d (actual) vs %d (expected) \nResults:\n\t%s\n", len(results), expectedNumber, strings.Join(results, "\n\t"))
+	}
+	return nil
+}
+
+func toSlice(value string) []string {
+	if strings.TrimSpace(value) == "" {
+		return []string{}
+	}
+
+	return strings.Split(value, ",")
+}
+
+func toMap(slice []string) map[string]struct{} {
+	result := make(map[string]struct{}, len(slice))
+	for _, value := range slice {
+		if _, ok := result[value]; !ok {
+			result[value] = struct{}{}
+		}
+	}
+	return result
+}
+
+func contains(input map[string]struct{}, value string) bool {
+	_, ok := input[value]
+	return ok
 }

v2/cmd/integration-test/loader.go

@@ -0,0 +1,171 @@
+package main
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+
+	"github.com/julienschmidt/httprouter"
+
+	"github.com/projectdiscovery/nuclei/v2/pkg/testutils"
+)
+
+var loaderTestcases = map[string]testutils.TestCase{
+	"loader/template-list.yaml":             &remoteTemplateList{},
+	"loader/workflow-list.yaml":             &remoteWorkflowList{},
+	"loader/nonexistent-template-list.yaml": &nonExistentTemplateList{},
+	"loader/nonexistent-workflow-list.yaml": &nonExistentWorkflowList{},
+	"loader/template-list-not-allowed.yaml": &remoteTemplateListNotAllowed{},
+}
+
+type remoteTemplateList struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *remoteTemplateList) Execute(templateList string) error {
+	router := httprouter.New()
+
+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		fmt.Fprintf(w, "This is test matcher text")
+		if strings.EqualFold(r.Header.Get("test"), "nuclei") {
+			fmt.Fprintf(w, "This is test headers matcher text")
+		}
+	})
+
+	router.GET("/template_list", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		file, err := os.ReadFile(templateList)
+		if err != nil {
+			w.WriteHeader(500)
+		}
+		_, err = w.Write(file)
+		if err != nil {
+			w.WriteHeader(500)
+		}
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	configFileData := `remote-template-domain: [ "` + ts.Listener.Addr().String() + `" ]`
+	err := ioutil.WriteFile("test-config.yaml", []byte(configFileData), os.ModePerm)
+	if err != nil {
+		return err
+	}
+	defer os.Remove("test-config.yaml")
+
+	results, err := testutils.RunNucleiBareArgsAndGetResults(debug, "-target", ts.URL, "-tu", ts.URL+"/template_list", "-config", "test-config.yaml")
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 2)
+}
+
+type remoteTemplateListNotAllowed struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *remoteTemplateListNotAllowed) Execute(templateList string) error {
+	router := httprouter.New()
+
+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		fmt.Fprintf(w, "This is test matcher text")
+		if strings.EqualFold(r.Header.Get("test"), "nuclei") {
+			fmt.Fprintf(w, "This is test headers matcher text")
+		}
+	})
+
+	router.GET("/template_list", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		file, err := os.ReadFile(templateList)
+		if err != nil {
+			w.WriteHeader(500)
+		}
+		_, err = w.Write(file)
+		if err != nil {
+			w.WriteHeader(500)
+		}
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	_, err := testutils.RunNucleiBareArgsAndGetResults(debug, "-target", ts.URL, "-tu", ts.URL+"/template_list")
+	if err == nil {
+		return fmt.Errorf("expected error for not allowed remote template list url")
+	}
+
+	return nil
+
+}
+
+type remoteWorkflowList struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *remoteWorkflowList) Execute(workflowList string) error {
+	router := httprouter.New()
+
+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		fmt.Fprintf(w, "This is test matcher text")
+		if strings.EqualFold(r.Header.Get("test"), "nuclei") {
+			fmt.Fprintf(w, "This is test headers matcher text")
+		}
+	})
+
+	router.GET("/workflow_list", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		file, err := os.ReadFile(workflowList)
+		if err != nil {
+			w.WriteHeader(500)
+		}
+		_, err = w.Write(file)
+		if err != nil {
+			w.WriteHeader(500)
+		}
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	configFileData := `remote-template-domain: [ "` + ts.Listener.Addr().String() + `" ]`
+	err := ioutil.WriteFile("test-config.yaml", []byte(configFileData), os.ModePerm)
+	if err != nil {
+		return err
+	}
+	defer os.Remove("test-config.yaml")
+
+	results, err := testutils.RunNucleiBareArgsAndGetResults(debug, "-target", ts.URL, "-wu", ts.URL+"/workflow_list", "-config", "test-config.yaml")
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 3)
+}
+
+type nonExistentTemplateList struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *nonExistentTemplateList) Execute(nonExistingTemplateList string) error {
+	router := httprouter.New()
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	_, err := testutils.RunNucleiBareArgsAndGetResults(debug, "-target", ts.URL, "-tu", ts.URL+"/404")
+	if err == nil {
+		return fmt.Errorf("expected error for nonexisting workflow url")
+	}
+
+	return nil
+}
+
+type nonExistentWorkflowList struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *nonExistentWorkflowList) Execute(nonExistingWorkflowList string) error {
+	router := httprouter.New()
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	_, err := testutils.RunNucleiBareArgsAndGetResults(debug, "-target", ts.URL, "-wu", ts.URL+"/404")
+	if err == nil {
+		return fmt.Errorf("expected error for nonexisting workflow url")
+	}
+
+	return nil
+}

v2/cmd/integration-test/network.go

@@ -3,22 +3,26 @@ package main
 import (
 	"net"
 
-	"github.com/projectdiscovery/nuclei/v2/internal/testutils"
+	"github.com/projectdiscovery/nuclei/v2/pkg/testutils"
 )
 
 var networkTestcases = map[string]testutils.TestCase{
-	"network/basic.yaml":      &networkBasic{},
-	"network/hex.yaml":        &networkBasic{},
-	"network/multi-step.yaml": &networkMultiStep{},
+	"network/basic.yaml":          &networkBasic{},
+	"network/hex.yaml":            &networkBasic{},
+	"network/multi-step.yaml":     &networkMultiStep{},
+	"network/self-contained.yaml": &networkRequestSelContained{},
+	"network/variables.yaml":      &networkVariables{},
 }
 
+const defaultStaticPort = 5431
+
 type networkBasic struct{}
 
-// Executes executes a test case and returns an error if occurred
+// Execute executes a test case and returns an error if occurred
 func (h *networkBasic) Execute(filePath string) error {
 	var routerErr error
 
-	ts := testutils.NewTCPServer(func(conn net.Conn) {
+	ts := testutils.NewTCPServer(nil, defaultStaticPort, func(conn net.Conn) {
 		defer conn.Close()
 
 		data := make([]byte, 4)
@@ -32,26 +36,24 @@ func (h *networkBasic) Execute(filePath string) error {
 	})
 	defer ts.Close()
 
-	results, err := testutils.RunNucleiAndGetResults(filePath, ts.URL, debug)
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug)
 	if err != nil {
 		return err
 	}
 	if routerErr != nil {
 		return routerErr
 	}
-	if len(results) != 1 {
-		return errIncorrectResultsCount(results)
-	}
-	return nil
+
+	return expectResultsCount(results, 1)
 }
 
 type networkMultiStep struct{}
 
-// Executes executes a test case and returns an error if occurred
+// Execute executes a test case and returns an error if occurred
 func (h *networkMultiStep) Execute(filePath string) error {
 	var routerErr error
 
-	ts := testutils.NewTCPServer(func(conn net.Conn) {
+	ts := testutils.NewTCPServer(nil, defaultStaticPort, func(conn net.Conn) {
 		defer conn.Close()
 
 		data := make([]byte, 5)
@@ -75,15 +77,74 @@ func (h *networkMultiStep) Execute(filePath string) error {
 	})
 	defer ts.Close()
 
-	results, err := testutils.RunNucleiAndGetResults(filePath, ts.URL, debug)
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug)
 	if err != nil {
 		return err
 	}
 	if routerErr != nil {
 		return routerErr
 	}
-	if len(results) != 1 {
-		return errIncorrectResultsCount(results)
+
+	var expectedResultsSize int
+	if debug {
+		expectedResultsSize = 3
+	} else {
+		expectedResultsSize = 1
 	}
-	return nil
+
+	return expectResultsCount(results, expectedResultsSize)
+}
+
+type networkRequestSelContained struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *networkRequestSelContained) Execute(filePath string) error {
+	var routerErr error
+
+	ts := testutils.NewTCPServer(nil, defaultStaticPort, func(conn net.Conn) {
+		defer conn.Close()
+
+		_, _ = conn.Write([]byte("Authentication successful"))
+	})
+	defer ts.Close()
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, "", debug)
+	if err != nil {
+		return err
+	}
+	if routerErr != nil {
+		return routerErr
+	}
+
+	return expectResultsCount(results, 1)
+}
+
+type networkVariables struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *networkVariables) Execute(filePath string) error {
+	var routerErr error
+
+	ts := testutils.NewTCPServer(nil, defaultStaticPort, func(conn net.Conn) {
+		defer conn.Close()
+
+		data := make([]byte, 4)
+		if _, err := conn.Read(data); err != nil {
+			routerErr = err
+			return
+		}
+		if string(data) == "PING" {
+			_, _ = conn.Write([]byte("aGVsbG8="))
+		}
+	})
+	defer ts.Close()
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug)
+	if err != nil {
+		return err
+	}
+	if routerErr != nil {
+		return routerErr
+	}
+
+	return expectResultsCount(results, 1)
 }

v2/cmd/integration-test/ssl.go

@@ -0,0 +1,99 @@
+package main
+
+import (
+	"crypto/tls"
+	"net"
+
+	"github.com/projectdiscovery/nuclei/v2/pkg/testutils"
+)
+
+var sslTestcases = map[string]testutils.TestCase{
+	"ssl/basic.yaml":          &sslBasic{},
+	"ssl/basic-ztls.yaml":     &sslBasicZtls{},
+	"ssl/custom-cipher.yaml":  &sslCustomCipher{},
+	"ssl/custom-version.yaml": &sslCustomVersion{},
+}
+
+type sslBasic struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *sslBasic) Execute(filePath string) error {
+	ts := testutils.NewTCPServer(&tls.Config{}, defaultStaticPort, func(conn net.Conn) {
+		defer conn.Close()
+		data := make([]byte, 4)
+		if _, err := conn.Read(data); err != nil {
+			return
+		}
+	})
+	defer ts.Close()
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug)
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 1)
+}
+
+type sslBasicZtls struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *sslBasicZtls) Execute(filePath string) error {
+	ts := testutils.NewTCPServer(&tls.Config{}, defaultStaticPort, func(conn net.Conn) {
+		defer conn.Close()
+		data := make([]byte, 4)
+		if _, err := conn.Read(data); err != nil {
+			return
+		}
+	})
+	defer ts.Close()
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug, "-ztls")
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 1)
+}
+
+type sslCustomCipher struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *sslCustomCipher) Execute(filePath string) error {
+	ts := testutils.NewTCPServer(&tls.Config{CipherSuites: []uint16{tls.TLS_AES_128_GCM_SHA256}}, defaultStaticPort, func(conn net.Conn) {
+		defer conn.Close()
+		data := make([]byte, 4)
+		if _, err := conn.Read(data); err != nil {
+			return
+		}
+	})
+	defer ts.Close()
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug)
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 1)
+}
+
+type sslCustomVersion struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *sslCustomVersion) Execute(filePath string) error {
+	ts := testutils.NewTCPServer(&tls.Config{MinVersion: tls.VersionTLS12, MaxVersion: tls.VersionTLS12}, defaultStaticPort, func(conn net.Conn) {
+		defer conn.Close()
+		data := make([]byte, 4)
+		if _, err := conn.Read(data); err != nil {
+			return
+		}
+	})
+	defer ts.Close()
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug)
+	if err != nil {
+		return err
+	}
+
+	return expectResultsCount(results, 1)
+}