Advanced Scripting Engine

[Mzack9999]

This PR extends the DSL language capability with pythonic syntax:

- type: dsl
        name: dsl-example
        dsl:
          - "body.contains('test') and status_code in (200,201,202)"

[Mzack9999]

• Context aware json fuzzer, encode the payload to a valid json

id: json-fuzz-scan
info:
  name: json-fuzzing
  author: pdteam
  severity: info
  description: jdam json
  tags: fuzz
requests:
  - payloads:
      payload_to_inject: params.txt
    attack: sniper
    raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json, text/plain, */*
        Accept-Language: en-US,en;q=0.5
        Referer: {{BaseURL}}

        {{json_encode({'key_one': 'anyvalue', 'key_two': payload_to_inject})}}

    matchers:
      - type: status
        status:
          - 200

• Php serialize- generates valid php serialized objects

info:
  name: php-serialize-rce
  author: pdteam
  severity: info
  description: php serialize rce
  tags: fuzz
requests:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

        Using php code or json => object
        {{php_serialize('new vulnerable_class()->class_param = 'phpinfo();')}}
        {{php_serialize({'a': 'phpinfo();'})}}

    matchers:
      - type: status
        status:
          - 200

• Cross-template interaction (with pythonic syntax)

args = {
    'URL': URL,
    'cookies': a, # External variable - eg. nuclei -t advanced-template.ncl -var a=blabla
}
# Invoke one/template.yaml with placeholders populated with the values from args + the ones defined within the template
# Saves extractors and matchers in res1 structure
res = run('one/template.yaml', args1)
# Pass the output of "one/template.yaml" as input to "another/template.yaml" (cookies, tokens, extracted data, etc)
run('another/template.yaml', res)

[dwisiswant0]

[Mzack9999]

Imcomplete PoC from https://0xpatrik.com/subdomain-takeover-ns/ (eg print needs to be replaced with helper functions to export data or trigger actions):

def testns(tracedata, host):
  for ns_server in tracedata["ns"]:
    # Check existence of base domain
    ns_data = dnsx_lookup(domain(ns_server))
    # Non existent?
    if not ns_data["a"] or ns_data["status_code"] != "NOERROR" :
      print("takeover of ns top domain for " + ns_server)
    ns_data = dnsx_lookup(ns_server)
    for ns_ip in ns_data["a"]:
      # Resolve against exactly one nameserver
      hostdata = dnsx_lookup_with_resolver(host, ns_ip)
      # Weird status?
      if not hostdata["a"] or hostdata["status_code"] != "NOERROR":
        print("takeover of " + host + " with resolver " + ns_ip)

testns(dnsx_trace(URL), URL)

[0xcrypto]

Oh well, you guys could just embed python or lua to make it easier for everyone.

[Mzack9999]

Github auto-merge keeps failing - restarting at #914