nuclei 模板编写踩坑

一点吐槽

yaml格式

多一个空格都不行，真的很严格

Untitled

请求合并

请求合并是非常优秀的功能，但是在部分场景下会无法合并,例如

1
2
3
4


http:
  - method: GET
    path:
      - "{{BaseURL}}"

1
2
3
4
5
6
7


http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

Untitled

又例如

1
2
3
4
5
6
7


http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

1
2
3
4
5
6
7
8


http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/aaa"

    host-redirects: true
    max-redirects: 2

Untitled

workflow的请求合并

在workflow的扫描流程中

即使finger的扫描请求完全一致，请求也是拆分出来的，无法自动合并，估计是实现逻辑上的问题。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


id: test1-workflow

info:
  name: test1 workflow
  author: aaaa

workflows:
  - template: /tmp/test1-detect.yaml
    subtemplates:
      - template: /tmp/test1/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


id: test2-workflow

info:
  name: test2 workflow
  author: aaaa

workflows:
  - template: /tmp/test2-detect.yaml
    subtemplates:
      - template: /tmp/test2/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


id: test1-detect

info:
  name: test1-detect
  author: aaa
  severity: info
  tags: tech

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


id: test2-detect

info:
  name: test2-detect
  author: aaa
  severity: info
  tags: tech

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

Untitled

变量解析

之前遇到的问题了

提的issue

1
2
3
4
5
6
7


requests:
  - method: GET
    path:
      - "{{BaseURL}}/{{123123}}"
      - "{{BaseURL}}/{{aaabbb}}"
      - "{{BaseURL}}/{{123*123}}"
      - "{{BaseURL}}/{{123!123}}"

主要在于解析的情况不一致

https://github.com/projectdiscovery/nuclei/issues/1497

后面在版本更新中得以解决