ProjectDiscovery
OWASP Top 10 Attack and Nuclei Scan Details Reports #2646
-
|
I recently downloaded latest version(2.7.7) of nuclei with Nuclei Templates 9.2.1, I have following questions:
|
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 3 replies
-
|
Have you checked out the documentation at https://nuclei.projectdiscovery.io/ or the CLI help?
We haven't categorized our templates in that way, hence the short answer is that you can't, BUT you can control which ones to execute based on their tags. E.g.
Interactsh is a service which integrates seamlessly with nuclei to enable blind OOB testing (e.g. detecting SSRF). It either requires internet access or you need to deploy your own instance. For more info check out the https://github.com/projectdiscovery/interactsh project.
Nuclei tests the given input (usually root domains) for specific vulnerabilities. It doesn't do fully automated crawling or fuzzing YET. Those are separate projects which aren't released publicly yet and will be integrated later on. The power of
Please read the documentation: https://nuclei.projectdiscovery.io/nuclei/get-started/#nuclei-reporting
Integration with other ProjectDiscovery tools:
If you would like additional details, you can ask them at our Discord channel. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @forgedhallpass for detailed response. Below is my understanding: a) Running below command would execute all the attack tests: d) Currently Crawling/Fuzzing is not Supported. It should be possible by changing different URLs using Scripts. |
Beta Was this translation helpful? Give feedback.
-
|
a) That command will load all general purpose templates (~4000 if you use the official public templates only), excluding those that are tagged with b) We have tickets created for HTML and PDF and they will be implemented at some point. Besides Example markdown report ( Wappalyzer Technology Detection (tech-detect:python) found on http://localhost:8081Details: tech-detect:python matched at http://localhost:8081 Protocol: HTTP Full URL: http://localhost:8081 Timestamp: Wed Sep 28 14:06:32 +0300 EEST 2022 Template Information
Request GET / HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Response HTTP/1.0 200 OK
Connection: close
Content-Length: 591
Content-Type: text/html; charset=utf-8
Date: Wed, 28 Sep 2022 11:06:32 GMT
Server: SimpleHTTP/0.6 Python/3.10.6
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Directory listing for /</title>
</head>
<body>
<h1>Directory listing for /</h1>
<hr>
<ul>
<li><a href=".git/">.git/</a></li>
<li><a href=".idea/">.idea/</a></li>
<li><a href="cmd/">cmd/</a></li>
<li><a href="go.mod">go.mod</a></li>
<li><a href="go.sum">go.sum</a></li>
<li><a href="LICENSE">LICENSE</a></li>
<li><a href="pkg/">pkg/</a></li>
<li><a href="README.md">README.md</a></li>
</ul>
<hr>
</body>
</html>CURL Command Generated by Nuclei 2.7.7Additionally you can use {
"template": "technologies/tech-detect.yaml",
"template-url": "https://github.com/projectdiscovery/nuclei-templates/blob/master/technologies/tech-detect.yaml",
"template-id": "tech-detect",
"info": {
"name": "Wappalyzer Technology Detection",
"author": [
"hakluke"
],
"tags": [
"tech"
],
"reference": null,
"severity": "info"
},
"matcher-name": "python",
"type": "http",
"host": "http://localhost:8081",
"matched-at": "http://localhost:8081",
"ip": "127.0.0.1",
"timestamp": "2022-09-28T14:31:07.330193+03:00",
"curl-command": "curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36' 'http://localhost:8081'",
"matcher-status": true,
"matched-line": null
}c) The findings are show on the , in the Before providing targets and running the scan you can prepare your command and see what templates would be loaded. nuclei -tags atlassian -severity medium,high,critical -vv
d) Not sure what do you mean by should be possible by changing different URLs. As mentioned in the previous response, and also if you open up a couple of templates you will see that the majority of them expect root URLs and they add the required paths automatically to do targeted checks. That being said, this doesn't mean that it's not possible already to some extent. You can use different attack types ( Example templates:
The relevant documentation can be found under HTTP fuzzing. Even though the majority of the templates require root URLs, there are still exceptions, like the If you would like to expand your attack surface, you could start from a domain or list of domains, use Our tools are designed to be modular, but easily integratable (they can even be used as |
Beta Was this translation helpful? Give feedback.
-
|
First of all Thanks @forgedhallpass for the very detailed response. Appreciate very much for that.
For the remaining points Thanks again, I will try out tommorow and get back to you. |
Beta Was this translation helpful? Give feedback.
-
If anyone needs to convert nuclei's JSON output to CSV, I wrote this little tool in Python. |
Beta Was this translation helpful? Give feedback.
Have you checked out the documentation at https://nuclei.projectdiscovery.io/ or the CLI help?
We haven't categorized our templates in that way, hence the short answer is that you can't, BUT you can control which ones to execute based on their tags.
E.g.
nuclei -tags xss,sqli -vv<- this will show you all the templates that do xss or sql injection testsInteractsh is a service which integrates seamlessly with nuclei to enable blind OOB …