search

projectdiscovery / nuclei

Fast and customizable vulnerability scanner based on simple YAML based DSL.
https://docs.projectdiscovery.io/tools/nuclei
MIT License
19.81k stars 2.44k forks source link

Add support for the duration matcher for network templates #5413

Open CodeStuffBreakThings opened 1 month ago

CodeStuffBreakThings commented 1 month ago

Add support for the duration matcher for network templates:

This would allow you to measure the amount of time between when a packet is sent and when a response is received. A match could be made based on the specified amount of measured time.

Use case:

Similar to how raw HTTP templates can use the duration matcher to measure the response time for HTTP requests, this would be applicable to network templates. For example, the duration matcher is useful for cases such as time-based SQL injection vulnerabilities, however not all payloads are delivered via HTTP requests and instead need to be delivered via TCP. There is currently not a way to measure the time between when a TCP/IP packet is sent and when the response is received; this feature would add this functionality.

GeorginaReeder commented 1 month ago

Thanks for your suggestion @CodeStuffBreakThings , we'll take a look into this!