chainreactors / neutron

nano nuclei engine. no side effect.
https://chainreactors.github.io/wiki/libs/neutron/
17 stars 7 forks source link

gogo-neutron解析template出错 #1

Closed 7rovu closed 7 months ago

7rovu commented 7 months ago

https://github.com/chainreactors/neutron/blob/master/templates_gogo/impl.go:25和31行有bug,在循环中使用指针会导致requests中所有路径均指向最后一个路径

e.g:使用如下poc会导致,进行两次/bbb/路径的请求

id: test
info:
  name: test
  severity: info
  tags: http

http:
  - method: GET
    path:
      - "{{BaseURL}}/aaa/"

    matchers:
      - type: word
        part: body
        words:
          - 'refresh'

  - method: GET
    path:
      - "{{BaseURL}}/bbb/"

    matchers:
      - type: word
        part: body
        words:
          - 'Found'
M09Ic commented 7 months ago

ref https://github.com/chainreactors/gogo/issues/52