Fuzzing is not working on my Custom Template

[snemmani]

I have tried all the suggestions provided in the templating guide. Yet fuzzing is not working on my template. I have also enabled the -debug flag on my command line command. Yet fuzzing is not working.

Template:

id: fuzz-reflection-xss

info:
  name: Basic Reflection Potential XSS Detection
  author: pdteam
  severity: low

http:
  - method: GET
    path:
      - "{{BaseURL}}/tags?$limit=1"
    payloads:
      reflection:
        - "6842'\"><9967"
    stop-at-first-match: true
    fuzzing:
      - part: query
        type: postfix
        mode: single
        fuzz:
          - "{{reflection}}"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{reflection}}"
      - name: null
        type: "dsl"
        regex: null
        words: null
        dsl:
        - "status_code >= 400 && status_code <= 500 && status_code != 404"

It is inside a directly labeled tmp

I am running the below command and the result is also pasted Inline.

nuclei -t tmp -u https://mytestwebsite.com -H "Authorization: Bearer SomeValidBearerToken"  -debug
                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.8

                projectdiscovery.io

[←[33mWRN←[0m] Found 24 template[s] loaded with deprecated paths, update before v3 for continued support.
[←[34mINF←[0m] Current nuclei version: v2.9.8 (←[92mlatest←[0m)
[←[34mINF←[0m] Current nuclei-templates version: v9.5.6 (←[92mlatest←[0m)
[←[34mINF←[0m] New templates added in latest release: 3
[←[34mINF←[0m] Templates loaded for current scan: 1
[←[34mINF←[0m] Targets loaded for current scan: 1
[←[34mINF←[0m] No results found. Better luck next time!

What intrigues me is the debug setting is also not displaying any requests and responses sent. But when I remove the fuzzing block. I can see some requests and responses. Please help.

[MetzinAround]

HI! Thanks for the issue.

templates with the fuzz tag are excluded by default, you have to use the -itags flag to make sure the fuzzing templates get run.

-itags, -include-tags string[] tags to be executed even if they are excluded either by default or configuration

try running
nuclei -t tmp -u https://mytestwebsite.com -H "Authorization: Bearer SomeValidBearerToken" -debug -itags fuzz

[snemmani]

I have tried with the -itags fuzz option as well. But it's not working.
Here's the output

nuclei -t tmp -u https://mytestwebsite.com -H "Authorization: Bearer SomeValidBearerToken"  -debug -itags fuzz

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.8

                projectdiscovery.io

[←[33mWRN←[0m] Found 24 template[s] loaded with deprecated paths, update before v3 for continued support.
[←[34mINF←[0m] Current nuclei version: v2.9.8 (←[92mlatest←[0m)
[←[34mINF←[0m] Current nuclei-templates version: v9.5.6 (←[92mlatest←[0m)
[←[34mINF←[0m] New templates added in latest release: 3
[←[34mINF←[0m] Templates loaded for current scan: 1
[←[34mINF←[0m] Targets loaded for current scan: 1
[←[34mINF←[0m] No results found. Better luck next time!

[MetzinAround]

Interesting. Thanks for this update. @olearycrew, do you see anything that stands out here?

[snemmani]

Should I create an issue from this @MetzinAround? Because currently I have gone back to manually creating fuzzed versions of the query parameters until this gets unblocked.

It would be a great help indeed if this worked.

[ehsandeep]

@snemmani currently fuzzing is performed on target input queries not based on template.

Here is the expected way to run:

nuclei -t test.yaml -u https://mytestwebsite.com/tags?$limit=1 -H "Authorization: Bearer SomeValidBearerToken" -v

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.8

		projectdiscovery.io

[INF] Current nuclei version: v2.9.8 (latest)
[INF] Current nuclei-templates version: v9.5.7 (latest)
[INF] New templates added in latest release: 21
[INF] Templates loaded for current scan: 1
[INF] Targets loaded for current scan: 1
[VER] [fuzz-reflection-xss] Sent HTTP request to https://mytestwebsite.com/tags?=16842'"><9967
[INF] No results found. Better luck next time!

fuzzing feature can be extended further to auto-merge template input.