About nuclei-templates structure

[daffainfo]

IMHO, when i check the content of each folder. Especially technologies and exposed-panel directory are very messy.

• File naming is still messy, for example in exposed-panel there are some template that named like this.
  • ***-panel.yaml
  • ***-login.yaml
  • ***-detect.yaml
  • ***-console.yaml
• Sometimes there are technologies templates that can be found in the exposed-panels folder. Or exposed-panels template sometimes can be found in the technologies folder
• Sometimes I confused why there is test page on technologies folder
• Why if there are folders for adobe, apache, dell, and others in technologies directory. But there is no folders for others are also created? Like the one in the default-login directory, that's very neat directory for me

[princechaddha]

Hello @daffainfo,

Thank you for starting this discussion and yes there are inconsistencies in the ids of the panel and tech templates. To be clear all the login endpoints, panels or dashboards are added to the exposed-panels directory, all the templates that detect a particular tech, test pages for a particular tech go under technologies.

We can start making enhancements to keep the naming of templates under the panel folder consistent, we can rename all the ***-detect.yaml templates to ***-panel.yaml, if we believe it is just detection for a particular tech and there is really no panel then we can move them to technologies folder. All the endpoints with login page will be renamed to ***-login.yaml unless the product name suggests otherwise for example, flureedb-admin-console, all the other templates will be renamed to ***-panel.yaml.

Let me know if it sounds good to you and we can start making the enhancements. Thank you

[daffainfo]

@princechaddha What about the templates that are in the folder (For example telesquare folder in exposed-panels) and some templates didn't have a specific folder

[princechaddha]

Yes, we can move templates related to popular products/vendors to their respective folders, rest are added without any separate directories, maybe we can have others folder just like vulnerabilities. What about tlr-2005ksh-login, looks alright to me?

[daffainfo]

@princechaddha ok looks good, I am waiting for the improvement :)

[dogasantos]

I'd add that we must have two separated master classes of templates:
DETECTION/FINGERPRINT
VULNERABILITY SCAN

And a very clear rule for PRs:
Is this a template for detection, or vulnerability scan/test?
templates for detection needs to add 'fingerprint' or 'detection' among its tags, so if you just want to run a fingerprint session against your targets, you can.

Not sure if this is the right place for this suggestion, but as we're talking about template structure... it seems to be a fit

[dogasantos]

PLUS:
should be mandatory add when PR:

• clear description of the vulnerability / detection
• CVSS base score and vector (3.1)
• CWE

[princechaddha]

Thank you, @dogasantos, for your suggestion. We are definitely planning to differentiate between detections and vulnerabilities more clearly. To help users filter out detection-only templates when running nuclei, we can label these templates with the detect tag.

Also, we don't include any detection templates in CVEs or vulnerabilities. If you come across any such templates, please let us know, and we will update them accordingly. Once again, thank you for your suggestion