mirror of
https://github.com/projectdiscovery/nuclei.git
synced 2026-11-11 04:01:35 -10:00
Dogan Can Bakir
1c440e755a
Hoist the unsigned code-template guard ahead of the dast branch so it applies on every load path.
34 lines
559 B
YAML
34 lines
559 B
YAML
id: dast-unsigned-code
|
|
|
|
info:
|
|
name: dast-unsigned-code
|
|
author: pdteam
|
|
severity: info
|
|
tags: dast,code
|
|
description: |
|
|
unsigned code paired with a fuzzable request must not execute under -dast
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/?x=1"
|
|
fuzzing:
|
|
- part: query
|
|
type: replace
|
|
mode: single
|
|
keys: ["x"]
|
|
fuzz:
|
|
- "test"
|
|
|
|
code:
|
|
- engine:
|
|
- py
|
|
- python3
|
|
source: |
|
|
print("unsigned code")
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "unsigned code"
|