ProjectDiscovery Stories

Nuclei v2.4.0 - Uniform, Stable & More Powerful

The new nuclei v2.4.0 release includes a slew of bug fixes and feature enhancements that improve the overall uniformity, stability, and functionality of the tool. Uniform This version includes improvements to the template execution process, with the nuclei-templates repository now serving as the default entry point. This means that when no templates are specified, the Nuclei engine executes all public templates (those that are not excluded) on the targets that have been specified. nuclei -u

Nuclei & Templates

Secrets Scanning with Nuclei

Within the v2.3.0 release, we've introduced File based scanning capabilities into the Nuclei engine. If you are already a Nuclei user, you will find it familiar because it follows the same principles as the HTTP based templates. We wanted to provide a similar approach to make writing your own file based templates simple and convenient. File protocol The File protocol template extension makes pattern-based file matching possible by enabling Nuclei to scan the desired parts of the file system.

Nuclei & Templates

Writing security templates for Apache Airflow

Apache Airflow is an Open Source tool that allows users "programmatically author, schedule and monitor workflows". We decided to create a suite of checks for testing security of Airflow installations and document the entire process to show how easy it is to write custom nuclei templates for any piece of technology. Environment Setup Before we start with template creation, we need to set up an airflow instance for testing. We found this repo on GitHub with the docker-compose file to set up a l

Learning & Automation

Nuclei + Interactsh Integration for Automating OOB Testing

We released interactsh, a server that can emulate a DNS, HTTP, HTTPS and SMTP server, allowing users to test for Out of Band Security vulnerabilities. Nuclei v2.3.6 now supports using the interact.sh API to achieve OOB based vulnerability scanning with automatic Request correlation built in. It's as easy as writing {{interactsh-url}} anywhere in the request, and adding a matcher for interact_protocol. Nuclei will handle correlation of the interaction to the template & the request it was generat

Nuclei & Templates

Interactsh: Open-Source Solution for OOB Testing

What is Interactsh? Interactsh is a server-client implementation that allows users to identify blind Out-of-Band (OOB) vulnerabilities that may not be detected by conventional testing methods. Out-of-Band testing works by generating dynamic URLs, which when requested by the target, trigger a callback. This callback can be used to identify a vulnerability. Why did we build Interactsh? We wanted an Open-Source solution for Blind OOB testing. Interactsh simplifies the server setup process. It

Learning & Automation

Exploiting Race conditions with Nuclei

What Is a Race Condition Vulnerability? A race condition attack happens when a computing system that’s designed to handle tasks in a specific sequence is forced to perform two or more operations simultaneously. This technique takes advantage of a time gap between the moment a service is initiated and the moment a security control takes effect. This attack, which depends on multithreaded applications, can be delivered in one of two ways: interference caused by untrusted processes (essentially a

Nuclei & Templates Vulnerability Management

Github Actions for Application Security

Update: PD-Actions GitHub project is suspended by GitHub team due to abuse of Actions platform by malicious actors using PD-Actions. "GitHub Actions help you automate tasks within your software development life cycle. GitHub Actions are event-driven, meaning that you can run a series of commands after a specified event has occurred. For example, every time someone creates a pull request for a repository, you can automatically run a command that executes a software testing script." What this m

Vulnerability Management Learning & Automation

Writing Network Templates with Nuclei

A step-by-step introduction to writing effective network fingerprinting and exploitation templates in Nuclei the easy way. We recently introduced TCP Network protocol templating capabilities to nuclei. The most common question has been about how these network templates are created. In this post, we will take a look at how one can effectively create templates for TCP-based protocol by using a simple packet capturing utility. There are two ways to create templates for network protocols - 1. Bl

Nuclei & Templates

Nuclei v2.3.0 Release

We are thrilled to bring you the new Nuclei v2.3.0! With this release, the entire core has seen a refactor and overhaul, focusing on modularity and future-proofing by adding the unit tests and integration tests. The release also comes with many exciting new features. Some massive ones being headless support, TCP support, file support for local filesystem templates. Reporting modules have been added for Jira, Github, Gitlab, and many more along the way. The workflow system has been written from

Nuclei & Templates

We are going fulltime

Most of you probably don't know, but ProjectDiscovery has been maintained in free-time, and we have been doing it so for the past 2 years. It was initially started when we met through the subfinder repository [https://github.com/projectdiscovery/subfinder] where we exchanged our ideas and started creating solutions out of a passion for open-source. We still remember when we released our first project, we were flipping out after getting the first 100 stars. There are so many memories around this

Nuclei - Fuzz all the things

The latest nuclei release has been a pretty big one with lots of new features added as well as bug fixes to existing code base. Significant new additions have been made in fuzzing as well templating capabilities of nuclei. Non-RFC Compliant Requests Earlier versions of nuclei used the base Go HTTP library. The requests were strictly validated and non-spec compliant requests were dropped. The new release comes with an unsafe attribute using our rawhttp library which allows sending any kind of

Nuclei & Templates

Nuclei Unleashed - Quickly write complex exploits

If you’re reading about nuclei for the first time, we suggest you start here at this blog post which introduces the basic idea behind nuclei. Stateful Dynamic requests One of the major limitation with previous versions of nuclei was the inability to perform multi-step or chained requests making it impossible to use it in a process where some dynamic state needed to be maintained or session needed to be created. With the latest release, you can very easily create such complex workflows with

Nuclei & Templates

ProjectDiscovery Stories

Nuclei v2.4.0 - Uniform, Stable & More Powerful

Secrets Scanning with Nuclei

Writing security templates for Apache Airflow

Nuclei + Interactsh Integration for Automating OOB Testing

Interactsh: Open-Source Solution for OOB Testing

Exploiting Race conditions with Nuclei

Github Actions for Application Security

Writing Network Templates with Nuclei

Nuclei v2.3.0 Release

We are going fulltime

Nuclei - Fuzz all the things

Nuclei Unleashed - Quickly write complex exploits

Monitor your infrastructure

Talk to sales

Platform

Open Source

Resources

Company