Skip to content

Commit bac9174

Browse files
ehsandeepehsandeep
authored
Merge pull request #5412 from projectdiscovery/dev
nuclei v3.3.0
2 parents 5018673 + 59e9363 commit bac9174

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

73 files changed

+1294
-694
lines changed

‎README.md

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,6 @@ CONFIGURATIONS:
203203
-sml, -show-match-line show match lines for file templates, works with extractors only
204204
-ztls use ztls library with autofallback to standard one for tls13 [Deprecated] autofallback to ztls is enabled by default
205205
-sni string tls sni hostname to use (default: input domain name)
206-
-dt, -dialer-timeout value timeout for network requests.
207206
-dka, -dialer-keep-alive value keep-alive duration for network requests.
208207
-lfa, -allow-local-file-access allows file (payload) access anywhere on the system
209208
-lna, -restrict-local-network-access blocks connections to the local / private network
@@ -212,7 +211,6 @@ CONFIGURATIONS:
212211
-sip, -source-ip string source ip address to use for network scan
213212
-rsr, -response-size-read int max response size to read in bytes
214213
-rss, -response-size-save int max response size to read in bytes (default 1048576)
215-
-rrt, -response-read-timeout value response read timeout in seconds (default 5s)
216214
-reset reset removes all nuclei configuration and data files (including nuclei-templates)
217215
-tlsi, -tls-impersonate enable experimental client hello (ja3) tls randomization
218216
-hae, -http-api-endpoint string experimental http api endpoint
@@ -238,7 +236,7 @@ FUZZING:
238236
UNCOVER:
239237
-uc, -uncover enable uncover engine
240238
-uq, -uncover-query string[] uncover search query
241-
-ue, -uncover-engine string[] uncover search engine (shodan,censys,fofa,shodan-idb,quake,hunter,zoomeye,netlas,criminalip,publicwww,hunterhow) (default shodan)
239+
-ue, -uncover-engine string[] uncover search engine (shodan,censys,fofa,shodan-idb,quake,hunter,zoomeye,netlas,criminalip,publicwww,hunterhow,google) (default shodan)
242240
-uf, -uncover-field string uncover fields to return (ip,port,host) (default "ip:port")
243241
-ul, -uncover-limit int uncover results to return (default 100)
244242
-ur, -uncover-ratelimit int override ratelimit of engines with unknown ratelimit (default 60 req/min) (default 60)
@@ -311,9 +309,10 @@ STATISTICS:
311309
-mp, -metrics-port int port to expose nuclei metrics on (default 9092)
312310

313311
CLOUD:
314-
-auth configure projectdiscovery cloud (pdcp) api key
315-
-cup, -cloud-upload upload scan results to pdcp dashboard
316-
-sid, -scan-id string upload scan results to given scan id
312+
-auth configure projectdiscovery cloud (pdcp) api key (default true)
313+
-cup, -cloud-upload upload scan results to pdcp dashboard
314+
-sid, -scan-id string upload scan results to existing scan id (optional)
315+
-sname, -scan-name string scan name to set (optional)
317316

318317
AUTHENTICATION:
319318
-sf, -secret-file string[] path to config file containing secrets for nuclei authenticated scan

‎SYNTAX-REFERENCE.md

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4339,19 +4339,6 @@ Code contains code to execute for the javascript request.
43394339

43404340
<div class="dd">
43414341

4342-
<code>timeout</code> <i>int</i>
4343-
4344-
</div>
4345-
<div class="dt">
4346-
4347-
Timeout in seconds is optional timeout for each javascript script execution (i.e init, pre-condition, code)
4348-
4349-
</div>
4350-
4351-
<hr />
4352-
4353-
<div class="dd">
4354-
43554342
<code>stop-at-first-match</code> <i>bool</i>
43564343

43574344
</div>

‎cmd/integration-test/loader.go

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,14 @@ func (h *nonExistentTemplateList) Execute(nonExistingTemplateList string) error
172172
ts := httptest.NewServer(router)
173173
defer ts.Close()
174174

175-
_, err := testutils.RunNucleiBareArgsAndGetResults(debug, nil, "-target", ts.URL, "-template-url", ts.URL+"/404")
175+
configFileData := `remote-template-domain: [ "` + ts.Listener.Addr().String() + `" ]`
176+
err := os.WriteFile("test-config.yaml", []byte(configFileData), permissionutil.ConfigFilePermission)
177+
if err != nil {
178+
return err
179+
}
180+
defer os.Remove("test-config.yaml")
181+
182+
_, err = testutils.RunNucleiBareArgsAndGetResults(debug, nil, "-target", ts.URL, "-template-url", ts.URL+"/404", "-config", "test-config.yaml")
176183
if err == nil {
177184
return fmt.Errorf("expected error for nonexisting workflow url")
178185
}
@@ -188,7 +195,14 @@ func (h *nonExistentWorkflowList) Execute(nonExistingWorkflowList string) error
188195
ts := httptest.NewServer(router)
189196
defer ts.Close()
190197

191-
_, err := testutils.RunNucleiBareArgsAndGetResults(debug, nil, "-target", ts.URL, "-workflow-url", ts.URL+"/404")
198+
configFileData := `remote-template-domain: [ "` + ts.Listener.Addr().String() + `" ]`
199+
err := os.WriteFile("test-config.yaml", []byte(configFileData), permissionutil.ConfigFilePermission)
200+
if err != nil {
201+
return err
202+
}
203+
defer os.Remove("test-config.yaml")
204+
205+
_, err = testutils.RunNucleiBareArgsAndGetResults(debug, nil, "-target", ts.URL, "-workflow-url", ts.URL+"/404", "-config", "test-config.yaml")
192206
if err == nil {
193207
return fmt.Errorf("expected error for nonexisting workflow url")
194208
}

‎cmd/nuclei/main.go

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,6 @@ on extensive configurability, massive extensibility and ease of use.`)
297297
flagSet.BoolVarP(&options.ShowMatchLine, "show-match-line", "sml", false, "show match lines for file templates, works with extractors only"),
298298
flagSet.BoolVar(&options.ZTLS, "ztls", false, "use ztls library with autofallback to standard one for tls13 [Deprecated] autofallback to ztls is enabled by default"), //nolint:all
299299
flagSet.StringVar(&options.SNI, "sni", "", "tls sni hostname to use (default: input domain name)"),
300-
flagSet.DurationVarP(&options.DialerTimeout, "dialer-timeout", "dt", 0, "timeout for network requests."),
301300
flagSet.DurationVarP(&options.DialerKeepAlive, "dialer-keep-alive", "dka", 0, "keep-alive duration for network requests."),
302301
flagSet.BoolVarP(&options.AllowLocalFileAccess, "allow-local-file-access", "lfa", false, "allows file (payload) access anywhere on the system"),
303302
flagSet.BoolVarP(&options.RestrictLocalNetworkAccess, "restrict-local-network-access", "lna", false, "blocks connections to the local / private network"),
@@ -306,7 +305,6 @@ on extensive configurability, massive extensibility and ease of use.`)
306305
flagSet.StringVarP(&options.SourceIP, "source-ip", "sip", "", "source ip address to use for network scan"),
307306
flagSet.IntVarP(&options.ResponseReadSize, "response-size-read", "rsr", 0, "max response size to read in bytes"),
308307
flagSet.IntVarP(&options.ResponseSaveSize, "response-size-save", "rss", unitutils.Mega, "max response size to read in bytes"),
309-
flagSet.DurationVarP(&options.ResponseReadTimeout, "response-read-timeout", "rrt", time.Duration(5*time.Second), "response read timeout in seconds"),
310308
flagSet.CallbackVar(resetCallback, "reset", "reset removes all nuclei configuration and data files (including nuclei-templates)"),
311309
flagSet.BoolVarP(&options.TlsImpersonate, "tls-impersonate", "tlsi", false, "enable experimental client hello (ja3) tls randomization"),
312310
flagSet.StringVarP(&options.HttpApiEndpoint, "http-api-endpoint", "hae", "", "experimental http api endpoint"),

‎examples/simple/simple.go

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,13 @@
11
package main
22

3-
import nuclei "github.com/projectdiscovery/nuclei/v3/lib"
3+
import (
4+
"context"
5+
6+
nuclei "github.com/projectdiscovery/nuclei/v3/lib"
7+
)
48

59
func main() {
6-
ne, err := nuclei.NewNucleiEngine(
10+
ne, err := nuclei.NewNucleiEngineCtx(context.Background(),
711
nuclei.WithTemplateFilters(nuclei.TemplateFilters{Tags: []string{"oast"}}),
812
nuclei.EnableStatsWithOpts(nuclei.StatsOptions{MetricServerPort: 6064}), // optionally enable metrics server for better observability
913
)

‎go.mod

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,12 @@ require (
2020
github.com/olekukonko/tablewriter v0.0.5
2121
github.com/pkg/errors v0.9.1
2222
github.com/projectdiscovery/clistats v0.0.20
23-
github.com/projectdiscovery/fastdialer v0.1.4-0.20240611222741-427bffb2ea13
24-
github.com/projectdiscovery/hmap v0.0.46
23+
github.com/projectdiscovery/fastdialer v0.1.6
24+
github.com/projectdiscovery/hmap v0.0.49
2525
github.com/projectdiscovery/interactsh v1.2.0
26-
github.com/projectdiscovery/rawhttp v0.1.51
27-
github.com/projectdiscovery/retryabledns v1.0.63
28-
github.com/projectdiscovery/retryablehttp-go v1.0.64
26+
github.com/projectdiscovery/rawhttp v0.1.57
27+
github.com/projectdiscovery/retryabledns v1.0.66
28+
github.com/projectdiscovery/retryablehttp-go v1.0.68
2929
github.com/projectdiscovery/yamldoc-go v1.0.4
3030
github.com/remeh/sizedwaitgroup v1.0.0
3131
github.com/rs/xid v1.5.0
@@ -58,6 +58,7 @@ require (
5858
github.com/aws/aws-sdk-go-v2/credentials v1.13.27
5959
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.72
6060
github.com/aws/aws-sdk-go-v2/service/s3 v1.37.0
61+
github.com/cespare/xxhash v1.1.0
6162
github.com/charmbracelet/glamour v0.6.0
6263
github.com/clbanning/mxj/v2 v2.7.0
6364
github.com/denisenkom/go-mssqldb v0.12.3
@@ -78,11 +79,11 @@ require (
7879
github.com/mholt/archiver v3.1.1+incompatible
7980
github.com/ory/dockertest/v3 v3.10.0
8081
github.com/praetorian-inc/fingerprintx v1.1.9
81-
github.com/projectdiscovery/dsl v0.1.2
82+
github.com/projectdiscovery/dsl v0.1.6
8283
github.com/projectdiscovery/fasttemplate v0.0.2
8384
github.com/projectdiscovery/go-smb2 v0.0.0-20240129202741-052cc450c6cb
84-
github.com/projectdiscovery/goflags v0.1.54
85-
github.com/projectdiscovery/gologger v1.1.12
85+
github.com/projectdiscovery/goflags v0.1.59
86+
github.com/projectdiscovery/gologger v1.1.14
8687
github.com/projectdiscovery/gostruct v0.0.2
8788
github.com/projectdiscovery/gozero v0.0.2
8889
github.com/projectdiscovery/httpx v1.6.3
@@ -93,9 +94,9 @@ require (
9394
github.com/projectdiscovery/sarif v0.0.1
9495
github.com/projectdiscovery/tlsx v1.1.6
9596
github.com/projectdiscovery/uncover v1.0.8
96-
github.com/projectdiscovery/useragent v0.0.54
97-
github.com/projectdiscovery/utils v0.1.4-0.20240611113448-0e2f2d33fe1c
98-
github.com/projectdiscovery/wappalyzergo v0.1.4
97+
github.com/projectdiscovery/useragent v0.0.60
98+
github.com/projectdiscovery/utils v0.2.1
99+
github.com/projectdiscovery/wappalyzergo v0.1.10
99100
github.com/redis/go-redis/v9 v9.1.0
100101
github.com/seh-msft/burpxml v1.0.1
101102
github.com/stretchr/testify v1.9.0
@@ -124,12 +125,11 @@ require (
124125
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.4 // indirect
125126
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
126127
github.com/bahlo/generic-list-go v0.2.0 // indirect
127-
github.com/bits-and-blooms/bitset v1.8.0 // indirect
128+
github.com/bits-and-blooms/bitset v1.13.0 // indirect
128129
github.com/bits-and-blooms/bloom/v3 v3.5.0 // indirect
129130
github.com/buger/jsonparser v1.1.1 // indirect
130131
github.com/bytedance/sonic v1.9.1 // indirect
131132
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
132-
github.com/cespare/xxhash v1.1.0 // indirect
133133
github.com/cespare/xxhash/v2 v2.2.0 // indirect
134134
github.com/cheggaaa/pb/v3 v3.1.4 // indirect
135135
github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
@@ -143,9 +143,10 @@ require (
143143
github.com/docker/cli v24.0.5+incompatible // indirect
144144
github.com/docker/docker v24.0.9+incompatible // indirect
145145
github.com/docker/go-connections v0.4.0 // indirect
146-
github.com/fatih/color v1.15.0 // indirect
146+
github.com/fatih/color v1.16.0 // indirect
147147
github.com/free5gc/util v1.0.5-0.20230511064842-2e120956883b // indirect
148148
github.com/gabriel-vasile/mimetype v1.4.2 // indirect
149+
github.com/gaissmai/bart v0.9.5 // indirect
149150
github.com/geoffgarside/ber v1.1.0 // indirect
150151
github.com/gin-contrib/sse v0.1.0 // indirect
151152
github.com/gin-gonic/gin v1.9.1 // indirect
@@ -199,8 +200,8 @@ require (
199200
github.com/pierrec/lz4/v4 v4.1.21 // indirect
200201
github.com/pjbgf/sha1cd v0.3.0 // indirect
201202
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
202-
github.com/projectdiscovery/asnmap v1.1.0 // indirect
203-
github.com/projectdiscovery/cdncheck v1.0.9 // indirect
203+
github.com/projectdiscovery/asnmap v1.1.1 // indirect
204+
github.com/projectdiscovery/cdncheck v1.1.0 // indirect
204205
github.com/projectdiscovery/freeport v0.0.5 // indirect
205206
github.com/projectdiscovery/ldapserver v1.0.2-0.20240219154113-dcc758ebc0cb // indirect
206207
github.com/projectdiscovery/machineid v0.0.0-20240226150047-2e2c51e35983 // indirect
@@ -267,7 +268,7 @@ require (
267268
github.com/google/uuid v1.6.0 // indirect
268269
github.com/gorilla/css v1.0.1 // indirect
269270
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
270-
github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
271+
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
271272
github.com/hdm/jarm-go v0.0.7 // indirect
272273
github.com/itchyny/timefmt-go v0.1.5 // indirect
273274
github.com/klauspost/cpuid/v2 v2.2.5 // indirect
@@ -284,15 +285,14 @@ require (
284285
github.com/pmezard/go-difflib v1.0.0 // indirect
285286
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
286287
github.com/projectdiscovery/blackrock v0.0.1 // indirect
287-
github.com/projectdiscovery/networkpolicy v0.0.8
288+
github.com/projectdiscovery/networkpolicy v0.0.9
288289
github.com/rivo/uniseg v0.4.6 // indirect
289290
github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d // indirect
290291
github.com/tklauser/go-sysconf v0.3.12 // indirect
291292
github.com/tklauser/numcpus v0.6.1 // indirect
292293
github.com/trivago/tgo v1.0.7
293294
github.com/ulikunitz/xz v0.5.12 // indirect
294295
github.com/valyala/bytebufferpool v1.0.0 // indirect
295-
github.com/yl2chen/cidranger v1.0.2 // indirect
296296
github.com/ysmood/goob v0.4.0 // indirect
297297
github.com/ysmood/gson v0.7.3 // indirect
298298
github.com/ysmood/leakless v0.8.0 // indirect

0 commit comments

Comments
 (0)