ProjectDiscovery Stories

The Ultimate Guide to Finding Bugs With Nuclei

Efficient, extensible, flexible, open source vulnerability scanning. Introduction Nuclei is a fast, efficient, and extensible vulnerability scanner. It can scan thousands of hosts in just a few minutes. The Nuclei engine uses YAML-based templates to define the steps required to detect a vulnerability. As an open-source tool we encourage community contributions to the library of templates, and development of the codebase. This means whenever a new CVE is published, someone can create a Nucle

Nuclei & Templates

Introducing ASNMap: A Golang CLI tool for speedy reconnaissance using ASN data

If you're into hacking, there's a good chance that at least one of ProjectDiscovery's tools has been added to your toolbox over the last couple of years. In all honesty, ProjectDiscovery's tools now make up the majority of my toolbox. For this reason, I get excited when they release something new, and ASNMap is no exception. What are ASNs? An Autonomous System (AS) is one or more IP prefixes, typically run by one network operator, with a clearly defined routing policy. An Autonomous System Nu

Attack Surface Management Community & Open Source

A Guide to DNS Takeovers: The Misunderstood Cousin of Subdomain Takeovers

Introduction Let's start with this: A DNS takeover is not the same as a subdomain takeover. Subdomain takeovers are old news. Hackers who caught onto them early made busloads of bounties by automating their detection and exploitation. They're still out there, but competition is fierce. Crafty hackers built bots that detect and report subdomain takeovers within minutes of them becoming vulnerable. DNS takeovers are the new Orange. They've become popular among seasoned bug bounty hunters, but a

Learning & Automation

Building Your Own Historical DNS Solution with DNSx

If you’ve been following these blogs, you’ll see that in the last article, we hacked together a basic attack surface monitoring platform using projectdiscovery tools. Using some of those basic building blocks, we’re going to build a basic historical DNS bot that will continuously enumerate domains and then alert us for the existence of new domains. We will also be able to request the results from a flask API. I will be forking the old project as a starting point, so if you haven’t already read

Attack Surface Management Learning & Automation

Hacking Together an ASM Platform Using ProjectDiscovery Tools

Introduction In this article, we’re going to walk through hacking together a simple attack surface monitoring platform by using ProjectDiscovery tools, bash, and flask. We will also be using MongoDB & Redis for scan data and scan queues. This tool was written for the pure purpose of this article, if you would like to contribute to it or fork the repository, I encourage you to! The whole concept of the ProjectDiscovery tool suite is that it is modular, allowing you to tweak it to your heart's c

Attack Surface Management

ProjectDiscovery's Best Kept Secrets

A tour of ProjectDiscovery's less-known public tools, and how to use them by @pry0cc Introduction For those unaware, ProjectDiscovery is a group of talented hackers and creators that have massively disrupted the offensive tooling industry by creating tooling that genuinely makes the lives of hackers easier. If you’re active in the offensive security industry or bug bounty, you’ve likely heard of some of their brilliant flagship tools such as nuclei, httpx, dnsx, naabu and subfinder. These ar

Learning & Automation

Interactsh v1.0.0

Interactsh v1.0.0 brings more stability, new protocols support, and a slew of other improvements and security fixes. Server Pool Support + random selection With new vulnerabilities being released recently which relied on DNS interactions (log4j), interactsh servers started receiving lot more load from nuclei scans than they could withstand. With the new interactsh release, the client has been modified to support a list of interactsh servers from which a server is randomly selected for use. T

Vulnerability Management

Abusing Reverse Proxies, Part 2: Internal Access

Introduction As seen in Part 1: Abusing Reverse Proxies: Metadata, open proxies can allow an attacker to access cloud metadata API services. However, even without metadata services available, open proxies can be a boon for an attacker. A primer on open proxy types: * Forward: typical use case is allowing private network users to access the internet via a common egress point. This allows an organization to make rules for which types of internet services are accessible to users. * Reverse:

Vulnerability Research Nuclei & Templates

Abusing Reverse Proxies, Part 1: Metadata

Introduction Many cloud service providers offer a "metadata" service on their virtual machines. These services offer sensitive details about the instance and cloud operating environment. Metadata services offer REST APIs to programmatically retrieve this data. Amazon’s AWS service defined the IMDSv1 “standard” on their EC2 instances, and since then many others have adopted this IMDSv1 scheme as well, including AWS, Google, and Azure. The services have generally settled on the IP address 169.254

Vulnerability Research Nuclei & Templates

Token Spray - Introduction to self-contained template

We search for secret leaks in a variety of places including GitHub, JS files, HTTP replies, source code, and other places. Once we've identified these keys, the next question is: what service does this key belong to, and is it valid? Answers to those questions determines the severity of the revealed token. Found a hardcoded client ID and client secret in some frontend. Now what? — jub0bs (@jub0bs) October 3, 2021 Keyhacks is a great project that provides valid examples of API requests fo

Nuclei & Templates

Nuclei v2.5.2 - First Security Release

We'd like to thank @c3l3si4n for disclosing the first security vulnerability that affects nuclei. This blog describes a brief overview of the security issue/impact and the measures we took to address it. Issue Summary The nuclei engine has a code execution vulnerability using components with known vulnerabilities that can be exploited by utilizing a specially crafted headless based template. Root Cause Nuclei relies on the go-rod library for a high level browser driver to run templates tha

Nuclei & Templates

Nuclei v2.5.0 Release

Nuclei YAML Syntax Documentation A common problem with YAML syntax is figuring out all the supported fields and their relevant documentation. With Nuclei, this has always been a barrier of entry for people new to the project. This Automatically Generated Documentation for Nuclei YAML Syntax is a step in this direction, making the Nuclei Syntax easier for people to understand and get working with. The documentation is generated using yamldoc-go, which is based on the amazing work of talos-syste

Nuclei & Templates

ProjectDiscovery Stories

The Ultimate Guide to Finding Bugs With Nuclei

Introducing ASNMap: A Golang CLI tool for speedy reconnaissance using ASN data

A Guide to DNS Takeovers: The Misunderstood Cousin of Subdomain Takeovers

Building Your Own Historical DNS Solution with DNSx

Hacking Together an ASM Platform Using ProjectDiscovery Tools

ProjectDiscovery's Best Kept Secrets

Interactsh v1.0.0

Abusing Reverse Proxies, Part 2: Internal Access

Abusing Reverse Proxies, Part 1: Metadata

Token Spray - Introduction to self-contained template

Nuclei v2.5.2 - First Security Release

Nuclei v2.5.0 Release

Monitor your infrastructure

Talk to sales

Platform

Open Source

Resources

Company