filter support to dast templates

projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

MIT License

20.72k stars 2.51k forks source link

Follow up for https://github.com/projectdiscovery/nuclei/pull/4925

[x] support for filters for old dast templates ( missing value of method variable )

variables:
  first: "cookie_injection"

http:
  - filters:
      - type: dsl
        dsl:
          - 'method == "GET"'
        condition: and

    payloads:
      reflection:
        - "{{first}}"

    fuzzing:
      - part: query
        type: postfix
        fuzz:
          - "{{reflection}}"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)(?i)(^set-cookie.*cookie_injection.*)'

[x] improve -dast (fuzz) option to load only dast based templates

projectdiscovery / nuclei

filter support to dast templates #4935