Welcome to the March edition of the ProjectDiscovery Community Newsletter. As we step into the blossoming season of spring, we are excited to bring you another round of updates, discoveries, and stories from our community.
Over the past month, we have continued our mission to democratize security, working closely with our community of cybersecurity enthusiasts. Your engagement and contributions have proven to be invaluable, and we're grateful for your support and the shared passion for cybersecurity that drives us.
As we march forward, we're eager to share the latest developments in vulnerability discovery, technological advancements, and community contributions. This newsletter serves as a spotlight for the vital research, innovative tools, and inspiring stories from our global members.
Thank you for being a part of our journey. Let's explore what this edition has in store! As always, we invite you to join us on GitHub and Discord, where we discuss security, best practices, and much more. See you there!
Release Notes
Nuclei v3.2
The latest release of Nuclei, v3.2, introduces significant updates aimed at enhancing the security scanning capabilities of the Nuclei engine. With new features such as authenticated scanning support and extended fuzzing capabilities, Nuclei v3.2 marks a major advancement in identifying and addressing security vulnerabilities. Authenticated scanning allows for more thorough examination of targets requiring login credentials, utilizing over 50 default-login templates with plans for expansion. The extended fuzzing support broadens the engine's ability to identify previously unknown vulnerabilities across various components, making this update a key development for cybersecurity professionals. Additionally, the release incorporates numerous security fixes, performance improvements, and support for additional protocols and input formats, further solidifying Nuclei's position as a comprehensive tool for cybersecurity analysis.
Learn more about v3.2 in the release notes and in our blog about v3.2.
Nuclei Authenticated Scanning
Nuclei v3.2.0 introduces the -secret-file flag for enhanced authenticated scanning of login-protected targets. The update simplifies integration of multiple authentication schemes via a YAML file, compatible with existing templates and eliminating the need for template changes. It supports static and dynamic methods, expanding Nuclei's scanning capabilities and paving the way for future integrations with top secret management systems. This simplifies scanning and highlights ProjectDiscovery's commitment to evolving Nuclei's utility amidst growing cybersecurity challenges.
Learn more in our blog “Scanning Login-Protected Targets with Nuclei v3.2”
Nuclei Advanced Fuzzing
Nuclei v3.2.0 introduces advanced fuzzing capabilities, significantly enhancing the open-source vulnerability scanner. This update broadens the scope of fuzzing with support for importing HTTP traffic and generating requests from API schemas like OpenAPI and Swagger, allowing for deeper and more precise vulnerability detection across various components of HTTP requests.
Learn more in our blog “Fuzzing for Unknown Vulnerabilities with Nuclei v3.2”
ASNMap v1.1.0
In asnmap v1.1.0, we added token authentication to ASNMap API through your PDCP account. The existing ASNMap API without authentication will continue operating until March 14th, 2024. This grace period allows existing users ample time to transition to the newly updated client. After this date, only the new authenticated API will be available, and the unauthenticated version will be discontinued.
naabu v2.3.0
The latest updates to naabu introduces new features and bug fixes to enhance its functionality and user experience. Notably, support for displaying results in real-time and the ability to specify a custom configuration file path have been added, the latter being contributed by new contributor @zmf963. Bug fixes include global sharing of pcap handlers and cleanup of interface handlers. Additionally, an issue with an undefined function error on OpenBSD was addressed.
katana v1.1.0
Version 1.1.0 introduces significant features and fixes to improve functionality and efficiency. New features include passive crawling options for discovering target endpoints using sources like Wayback Archive, Common Crawl, and Alien Vault, as demonstrated by discovering over 208,000 endpoints for tesla.com. Additionally, an option to exclude specific targets from crawling based on filters such as CDN, private IPs, CIDR, IP, or regex has been added. Bug fixes address issues with headless redirects, filter and match functionality in the SDK, and the -kf option related to exceeding maximum depth during operations.
Version 1.1.0 introduces significant features and fixes to improve functionality and efficiency. New features include passive crawling options for discovering target endpoints using sources like Wayback Archive, Common Crawl, and Alien Vault, as demonstrated by discovering over 208,000 endpoints for tesla.com. Additionally, an option to exclude specific targets from crawling based on filters such as CDN, private IPs, CIDR, IP, or regex has been added. Bug fixes address issues with headless redirects, filter and match functionality in the SDK, and the -kf option related to exceeding maximum depth during operations.
Nuclei Templates
March stats
Nuclei Templates' recent updates highlight significant expansions and enhancements in security scanning capabilities:
- Version 9.8.0 "Catch 'Em All: Network Vulnerabilities Latest" focuses on broadening network security checks, with the template library now boasting over 8,000 entries, including more than 7,202 templates for web applications, 2,200 web-related CVEs, and over 850 templates for identifying web vulnerabilities. This version invites contributors to focus on network vulnerability detection, leveraging the new JS protocol for easier network checks integration.
- Version 9.7.8 "Fishing for Phishing" introduces over 120 OSINT - Phishing Detection templates contributed by @rxerium, aimed at assisting OSINT analysts, threat researchers, and security professionals in identifying and studying phishing campaigns. These templates, not included in the default run, can be utilized through specific scan tags or OSINT scan configuration profiles.
- Version 9.7.7 adds new templates and CVEs, with contributions from various community members. This version added 82 new templates and addressed 21 CVEs, emphasizing the ongoing effort to cover the latest web vulnerabilities.
Each release not only adds to the tool's robustness in identifying a broad range of vulnerabilities but also showcases the project's commitment to community engagement and contribution, aiming for comprehensive coverage in web and network security.
Upcoming events
Hardly Strictly Security
Join us at Hardly Strictly Security (HSS), the unique conference dedicated to the power of open source in cybersecurity. This one-day, virtual event will explore how incorporating open source strategies can enhance security programs, covering everything from the basics to governance and scaling. It's the perfect venue for security engineers, red teams, bug bounty hunters, and open source enthusiasts eager to learn how to improve their security posture with open source tools.
Join our community
Our diverse community spans members from full-time bug bounty hunters to Fortune 500 security engineers.
