search

projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
https://docs.projectdiscovery.io/tools/nuclei
MIT License
20.79k stars 2.52k forks source link

Please support obfuscated encoding and kuo z for http posts #4717

Open hktalent opened 9 months ago

hktalent commented 9 months ago

For http post data, the ability of WAF has been enhanced

  1. If it is not Chunked or Multipart at present, perform Chunked and Multipart obfuscation encoding.
  2. It is already Chunked, perform Transfer-Encoding: compress-deflate encoding
  3. It is already Multipart. If it is regular form data, you can try to use Chunked for encoding.
  4. Of course, there is also the encoding of the url path
  5. Send data using IBM037 and utf7 encoding

I believe there are many coding methods to bypass WAF. ​ @tarunKoyalwar build_request.go

I originally wanted to try to participate, contribute, and complete this work. But I found that my energy was limited

olearycrew commented 9 months ago

Thanks for this set of ideas @hktalent

tarunKoyalwar commented 9 months ago

@hktalent , we can cover WAF bypass and maybe other tamper scripts via yaml template once https://github.com/projectdiscovery/nuclei/issues/4549 this is implemented also we have this global passive matcher/extractor issue on priority.

original idea was for matcher / extractor but we can maybe introduce mutator or something like that to modify specific parts of requests / response via dsl etc . and support tamper scripts like logic in sqlmap

hktalent commented 9 months ago

@olearycrew You're welcome

@tarunKoyalwar Once the plug-in is supported to pre-process data before sending, please tell me and I will participate in the contribution. In fact, I have another idea to send the data before sending to the server, and then use the server to complete the distribution of several scanners. , that is, the scanning of a target is completed by several distribution nodes, non-repetitive task allocation, and several different exit IPs, which may have a certain effect on firewall intervention.

hktalent commented 9 months ago

These are some of my practices in my own private projects, and I hope to contribute them to nuclei Let us continue to fight WAF and security defense continuously and never-endingly! This war will never end, it just depends on who is faster and ahead...

image
hktalent commented 9 months ago

@olearycrew @tarunKoyalwar Also, I would like to add that It is recommended that all http packages support plug-ins before sending them. I have another idea

  1. Once valid http smuggling is detected, all detections can be iterated to http smuggling into the traffic.
  2. Or iterate the traffic into SSRF traffic, that is, after using a certain vulnerability, iterate the nuclei traffic into the existing vulnerability and connect them in series. Originally I thought it was proxy-based, perhaps capturing all nuclei traffic, and then packaging and distributing it, or encapsulating it into existing vulnerabilities.