Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[enhancement] matcher with binary rule capability #31

Merged
merged 1 commit into from
Apr 21, 2020
Merged

[enhancement] matcher with binary rule capability #31

merged 1 commit into from
Apr 21, 2020

Conversation

toufik-airane
Copy link
Contributor

@toufik-airane toufik-airane commented Apr 21, 2020

Context

I thought that a matcher with binary rule capability could be interesting like Yara rules.
It's useful to match binary files such as archives.
In fact, the need to develop a dedicated matcher comes from the native utf-8 encoding from Golang.
I wanted to bypass the issue that I can't match characters such a: \x8a because Golang automatically handles it as \xc2\x8a.

So finally, after contribution #31, you can now invoke a binary matcher to handle hexadecimal rules.

Example

Take a look at this template projectdiscovery/nuclei-templates#42.
To resume, it enhances the capability to use hexadecimal input.

matchers:
      - type: binary
        binary:
        - "504B0304" # zip
        - "425A68" # bz2
        condition: or
        part: body

Proposed Changes

  • add a matcher named binary (BinaryMatcher)

add binary characters to the rules engine capability.
In fact, the issue is that I want to bypass the utf-8 issue with
Golang and have a dedicated capability to create binary rules.
@ehsandeep
Copy link
Member

This is amazing @toufik-airane, along with the hostname addition, the binary search makes this really useful with more possibility to look for.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants