Added fuzzing support for query params + var dump feature #2679

Ice3man543 · 2022-10-05T11:12:05Z

Proposed changes

Docs here - projectdiscovery/nuclei-docs#78

Example template

id: fuzz-reflection-xss

info:
  name: Basic Reflection Potential XSS Detection
  author: pdteam
  severity: low

requests:
  - method: GET
    path:
      - "{{BaseURL}}"

    payloads:
      reflection:
        - "another"
        - "test"

    fuzzing:
      - part: query
        fuzz:
          - "{{reflection}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{reflection}}"

      - type: word
        part: header
        words:
          - "text/html"

Example run

 ./nuclei -t template.yaml -u "https://example.com/?url=test&pass=new" -debug-req

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   2.7.8-dev

                projectdiscovery.io

[WRN] Use with caution. You are responsible for your actions.
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[INF] Using Nuclei Engine 2.7.8-dev (development)
[INF] Using Nuclei Templates 9.2.2 (latest)
[INF] Templates added in last update: 40
[INF] Templates loaded for scan: 1
[INF] [basic-template] Dumped HTTP request for https://example.com/?pass=new6842%27%22%3E%3C&url=test6842%27%22%3E%3C

GET /?pass=new6842%27%22%3E%3C&url=test6842%27%22%3E%3C HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

[INF] No results found. Better luck next time!

Checklist

Pull request is created against the dev branch
All checks passed (lint, unit/integration/regression tests etc.) with my changes
I have added tests that prove my fix is effective or that my feature works
I have added necessary documentation (if appropriate)

ehsandeep

payloads to support file input
payloads to support global dsl/variable
~~values to support global dsl/variable (nmi for why required)~~
~~keys to support global dsl/variable (nmi for why required)~~
uniform request block (tbd for usability)
mimic existing nuclei request behavior (tbd what is correct behaviour)
lint / build fix
docs update
keys-regex parameter add

… url-query-fuzzing

v2/cmd/integration-test/http.go

+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		w.Header().Set("Content-Type", "text/html")
+		value := r.URL.Query().Get("id")
+		fmt.Fprintf(w, "This is test matcher text: %v", value)


… url-query-fuzzing

…ry/nuclei into url-query-fuzzing

v2/cmd/tools/fuzzplayground/main.go

+func permissionsHandler(ctx echo.Context) error {
+	command := ctx.QueryParam("cmd")
+	fields := strings.Fields(command)
+	cmd := exec.Command(fields[0], fields[1:]...)


v2/cmd/tools/fuzzplayground/main.go

+
+func requestHandler(ctx echo.Context) error {
+	url := ctx.QueryParam("url")
+	data, err := http.Get(url)


v2/cmd/tools/fuzzplayground/main.go

+}
+
+func infoHandler(ctx echo.Context) error {
+	return ctx.HTML(200, fmt.Sprintf(bodyTemplate, fmt.Sprintf("Name of user: %s%s%s", ctx.QueryParam("name"), ctx.QueryParam("another"), ctx.QueryParam("random"))))


v2/cmd/tools/fuzzplayground/main.go

+		second, _ := strconv.Atoi(trimmed[1])
+		text = strconv.Itoa(first * second)
+	}
+	return ctx.HTML(200, fmt.Sprintf(bodyTemplate, fmt.Sprintf("Text: %s", text)))


v2/cmd/tools/fuzzplayground/main.go

+
+func redirectHandler(ctx echo.Context) error {
+	url := ctx.QueryParam("redirect_url")
+	return ctx.Redirect(302, url)


Ice3man543 · 2022-10-17T17:14:10Z

Docs here - projectdiscovery/nuclei-docs#78

ehsandeep

Merge conflict

… url-query-fuzzing

Mzack9999

lgtm - marking as "request changes" just to check if the following are known limitations:

Parameters with same name are flattened (eg. http://192.168.1.1/?id=1&id=2 => http://192.168.1.1/?id=fuzz)
replacement seems to be literal, without the capability to refer to the existing value for some custom manipulation via DSL (eg. {{md5(current_param_value+fuzz)}})

Ice3man543 · 2022-11-01T09:09:15Z

@Mzack9999 made the value of the parameter accessible as DSL value and also fixed the multiple keys with same name issue.

    payloads:
      reflection:
        - "1337"
   fuzzing:
      - part: query
        type: replace
        mode: single
        fuzz:
          - "{{concat(value,reflection,'somethingelse')}}"

GET /?test=new1337somethingelse HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

… url-query-fuzzing

Added fuzzing support for query params + var dump feature

d09c87e

Ice3man543 self-assigned this Oct 5, 2022

Ice3man543 added the Status: Review Needed The issue has a PR attached to it which needs to be reviewed label Oct 5, 2022

Ice3man543 requested review from ehsandeep and Mzack9999 October 5, 2022 11:12

This was linked to issues Oct 5, 2022

URL Query Parameter Fuzzing support #2529

Closed

Add flag for variable debug dump #2670

Closed

ehsandeep requested changes Oct 5, 2022

View reviewed changes

Ice3man543 added 2 commits October 5, 2022 20:48

Merge branch 'dev' of https://github.com/projectdiscovery/nuclei into…

fe23b71

… url-query-fuzzing

Added query-fuzz integration test

2bbceb9

github-advanced-security bot found potential problems Oct 5, 2022

View reviewed changes

Ice3man543 added 3 commits October 6, 2022 03:26

Fixed payloads + added keys-regex fuzz parameter

cb8fbb7

Fixed interactsh not working + misc

6536a04

Fixed evaluation + added global variables/dsl support to payloads

4507d60

ehsandeep removed the request for review from Mzack9999 October 6, 2022 08:20

ehsandeep added Status: In Progress This issue is being worked on, and has someone assigned. and removed Status: Review Needed The issue has a PR attached to it which needs to be reviewed labels Oct 6, 2022

Ice3man543 added 5 commits October 8, 2022 02:00

Merge branch 'dev' of https://github.com/projectdiscovery/nuclei into…

b454821

… url-query-fuzzing

Misc fixes related to variables evaluations

b495c12

Added http variables support to fuzz

64b02b8

misc

c303bd1

Misc

1ee6b29

ehsandeep mentioned this pull request Oct 11, 2022

Issue with variable value parsing with dsl function #2636

Closed

Mzack9999 mentioned this pull request Oct 11, 2022

DSL substitution issues #2601

Open

4 tasks

ehsandeep and others added 3 commits October 15, 2022 15:25

Merge branch 'dev' into url-query-fuzzing

991eabc

Added testing playground + misc renaming

305607b

Merge branch 'url-query-fuzzing' of https://github.com/projectdiscove…

2876701

…ry/nuclei into url-query-fuzzing

github-advanced-security bot found potential problems Oct 15, 2022

View reviewed changes

Ice3man543 requested a review from ehsandeep October 15, 2022 22:17

Added support for path and raw request to fuzzing

7a934c9

Ice3man543 added 2 commits October 17, 2022 19:47

Fixed fuzz integration test

06f476b

Fixed variable unresolved issue

38efb0b

ehsandeep added Status: Review Needed The issue has a PR attached to it which needs to be reviewed and removed Status: In Progress This issue is being worked on, and has someone assigned. labels Oct 25, 2022

ehsandeep requested changes Oct 25, 2022

View reviewed changes

ehsandeep requested a review from Mzack9999 October 25, 2022 18:37

Merge branch 'dev' of https://github.com/projectdiscovery/nuclei into…

f58d2d6

… url-query-fuzzing

Mzack9999 requested a review from ehsandeep October 30, 2022 06:59

Mzack9999 requested changes Oct 30, 2022

View reviewed changes

Ice3man543 added 2 commits October 31, 2022 21:08

Add multiple parameter support with same name

27a9dab

Added parameter value as 'value' dsl variable for parts

3d7f4f9

Ice3man543 requested a review from Mzack9999 November 1, 2022 09:09

Merge branch 'dev' of https://github.com/projectdiscovery/nuclei into…

2d17f91

… url-query-fuzzing

ehsandeep approved these changes Nov 1, 2022

View reviewed changes

ehsandeep merged commit b9472cf into dev Nov 1, 2022

ehsandeep deleted the url-query-fuzzing branch November 1, 2022 14:58

ehsandeep removed the Status: Review Needed The issue has a PR attached to it which needs to be reviewed label Nov 1, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added fuzzing support for query params + var dump feature #2679

Added fuzzing support for query params + var dump feature #2679

Ice3man543 commented Oct 5, 2022 •

edited by ehsandeep

Loading

ehsandeep left a comment •

edited by Ice3man543

Loading

Ice3man543 commented Oct 17, 2022

ehsandeep left a comment

Mzack9999 left a comment •

edited by ehsandeep

Loading

Ice3man543 commented Nov 1, 2022

Added fuzzing support for query params + var dump feature #2679

Added fuzzing support for query params + var dump feature #2679

Conversation

Ice3man543 commented Oct 5, 2022 • edited by ehsandeep Loading

Proposed changes

Checklist

ehsandeep left a comment • edited by Ice3man543 Loading

Choose a reason for hiding this comment

Ice3man543 commented Oct 17, 2022

ehsandeep left a comment

Choose a reason for hiding this comment

Mzack9999 left a comment • edited by ehsandeep Loading

Choose a reason for hiding this comment

Ice3man543 commented Nov 1, 2022

Ice3man543 commented Oct 5, 2022 •

edited by ehsandeep

Loading

ehsandeep left a comment •

edited by Ice3man543

Loading

Mzack9999 left a comment •

edited by ehsandeep

Loading