search

projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.
https://github.com/projectdiscovery/nuclei
MIT License
8.96k stars 2.56k forks source link

Cookie extractor with headless #3440

Open marcelo321 opened 2 years ago

marcelo321 commented 2 years ago

I want to do the same https://github.com/projectdiscovery/nuclei-templates/issues/3054 does, but with headless. The reason is some sites set cookies via JS, so if not visited with headless (or browser), some cookies won't be set.

I tried making the template for a solid 15 minutes but I keep failing to do it, so asking here for help to make it... maybe it is easier that it seems.

Also would need to have redirects: true like in a normal template, which I don't really know where it would go in this situation.

marcelo321 commented 2 years ago

update:

So the following template almost does the job, but doesn't get all the cookies (I assume that's because it is not following all the redirects in the site I am testing).

headless:
  - steps:
      - args:
          url: "{{BaseURL}}"
        action: navigate
      - action: waitload
      - action: script
        name: extract
        args:
          code: |
            document.cookie;
    extractors:
      - type: kval
        part: extract
        kval:
          - extract

Anyone has an idea if it is possible to make it work? The site where I am testing it, once you visit https://site.com it redirects to another path, and then makes a request to another path via JS and auto-sending a form, which sets 3 new cookies.

This is not picked up by this template, so not sure if it is even possible or not.