Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

urlencode key characters only #3150

Merged
merged 2 commits into from
Jan 5, 2023
Merged

urlencode key characters only #3150

merged 2 commits into from
Jan 5, 2023

Conversation

tarunKoyalwar
Copy link
Member

@tarunKoyalwar tarunKoyalwar commented Jan 4, 2023

Proposed changes

  • The Default url.values encoded any/all reserved characters which certain payloads ex: sqli , xss etc
    • Example template CVE-2022-0785
  • urlutil.Params is used instead of url.values which only encodes key characters (similar to burp and xss tools adds url encoders utils#42 )
    • Only Certain char are encoded which are necessary/breaking ex: space,[] etc
    • Now it is possible to send raw payloads ex: ?xss="><script>alert(1)</script> without encoding <,' and other breaking payload logic

closes #2698

Checklist

  • Pull request is created against the dev branch
  • All checks passed (lint, unit/integration/regression tests etc.) with my changes
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)

@tarunKoyalwar
Copy link
Member Author

Example

Before this PR

nuclei -u https://scanme.sh -id CVE-2022-0785  -v

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.8.5

		projectdiscovery.io

...
[INF] Using Nuclei Engine 2.8.5 (latest)
[INF] Using Nuclei Templates 9.3.3 (latest)
[INF] Templates added in last update: 238
[INF] Templates loaded for scan: 1
[INF] Targets loaded for scan: 1
[VER] [CVE-2022-0785] Sent HTTP request to https://scanme.sh/wp-admin/admin-ajax.php?action=get_monthly_timetable&month=1+AND+%28SELECT+6881+FROM+%28SELECT%28SLEEP%286%29%29%29iEAn%29
[INF] No results found. Better luck next time!
tarun@Taruns-MacBook-Pro:~/nuclei-templates » 

With this PR

 go run . -u https://scanme.sh -id CVE-2022-0785  -v                                                                    

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.8.5

		projectdiscovery.io

...
[INF] Using Nuclei Engine 2.8.5 (latest)
[INF] Using Nuclei Templates 9.3.3 (latest)
[INF] Templates added in last update: 238
[INF] Templates loaded for scan: 1
[INF] Targets loaded for scan: 1
[VER] [CVE-2022-0785] Sent HTTP request to https://scanme.sh/wp-admin/admin-ajax.php?action=get_monthly_timetable&month=1+AND+(SELECT+6881+FROM+(SELECT(SLEEP(6)))iEAn)
[INF] No results found. Better luck next time!

@tarunKoyalwar tarunKoyalwar self-assigned this Jan 4, 2023
@tarunKoyalwar tarunKoyalwar added Type: Enhancement Most issues will probably ask for additions or changes. Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors. labels Jan 4, 2023
@ehsandeep ehsandeep merged commit 4aa2002 into dev Jan 5, 2023
@ehsandeep ehsandeep deleted the issue-2698-urlencode-keychars branch January 5, 2023 11:12
@Mzack9999 Mzack9999 mentioned this pull request Jan 26, 2023
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors. Type: Enhancement Most issues will probably ask for additions or changes.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Disable encode query parameters by default when sending HTTP request in fuzzing template
4 participants