Input handling for network templates

[ehsandeep]

Please describe your feature request:

Current Template:

tcp:
  - inputs:
      - data: "Docker:\nVersion:\n"

    host:
      - "{{Host}}:2375"
      - "{{Hostname}}"

echo http://127.0.0.1 | nuclei -t test.yaml

[VER] Sent TCP request to example.com:2375
[VER] Sent TCP request to example.com:80

Expected Template:

tcp:
  - inputs:
      - data: "Docker:\nVersion:\n"

    host:
      - "{{Hostname}}:2375"

echo http://127.0.0.1 | nuclei -t test.yaml

[VER] Sent TCP request to example.com:2375

echo http://127.0.0.1:8080 | nuclei -t test.yaml

[VER] Sent TCP request to example.com:8080

Current format:

• both {{Host}} and {{Hostname}} is specified to support both pre-defined port + as other port with user input.
• keeping both format result into increased scan time, as one request from both is going to be timed out.

After update:

• As default ports will be hard coded into the network template, which will be used as the default
• Input with the port will overwrite the hardcoded port from the template

Describe the use case of this feature:

• This will avoid needing to define host with port and hostname to ensure hardcoded port and user-defined input is getting respected.
• This will reduce scan time (network templates) as, for now, one request will always result in a timeout.

[Mzack9999]

I can't entirely agree with the proposal. There is a consistent difference between {{host}} and {{hostname}}, and I don't think we should make any implicit reduction that might cause missing target scanning (both placeholders are within a template for a specific reason: cover user defined target:port and also cover the ports that are most likely to expose the service). In my opinion, #3821 already covers this case by applying a runtime duplicate target detection with the final connecting address if target:port turns out to be the same.

Generally, template definition should be declarative and explicit, and implicit behaviors should always be reduced to the bare minimum to maximize scanning coverage. It's up to the template writer to define the scope of the template (hardcoded port vs. hardcoded + user-defined)

[Mzack9999]

Superseded by #3954