Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue 2987 fuzz options #3355

Merged
merged 5 commits into from
Mar 6, 2023
Merged

Issue 2987 fuzz options #3355

merged 5 commits into from
Mar 6, 2023

Conversation

ShubhamRasal
Copy link
Contributor

@ShubhamRasal ShubhamRasal commented Feb 22, 2023

./nuclei -u "http://127.0.0.1:8082/email?text=important_user&text2=abc" -t ~/workspace/projectdisovery/fuzzing-templates/xss -silent
[reflected-xss] [http] [medium] http://127.0.0.1:8082/email?text=important_user'"><80478&text2=abc

Override type and mode using flag:

./nuclei -u "http://127.0.0.1:8082/email?text=important_user&text2=abc" -t ~/workspace/projectdisovery/fuzzing-templates/xss -fm multiple -ft prefix -silent
[reflected-xss] [http] [medium] http://127.0.0.1:8082/email?text='"><78899important_user&text2='"><78899abc

@ShubhamRasal ShubhamRasal marked this pull request as draft February 22, 2023 08:08
@ShubhamRasal ShubhamRasal marked this pull request as ready for review February 24, 2023 00:43
@ShubhamRasal ShubhamRasal self-assigned this Feb 26, 2023
Copy link
Member

@tarunKoyalwar tarunKoyalwar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm!

Copy link
Member

@ehsandeep ehsandeep left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ShubhamRasal, Can we add tests for this option as we have for others.

Copy link
Member

@Mzack9999 Mzack9999 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm - I couldn't find CLI override tests for other parameters such as AttackType. @ehsandeep, did you mean to implement functional tests?

@tarunKoyalwar
Copy link
Member

@ehsandeep @Mzack9999 not sure functional tests but I think we can implement this in integration_test since it has option to pass extra cli args

@ShubhamRasal
Copy link
Contributor Author

Agree with @tarunKoyalwar, I'll add the integration test to validate override fuzzing options.

- validate the command line overriding type and mode for fuzzing
router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
w.Header().Set("Content-Type", "text/html")
value := r.URL.Query().Get("id")
fmt.Fprintf(w, "This is test matcher text: %v", value)

Check warning

Code scanning / CodeQL

Reflected cross-site scripting

Cross-site scripting vulnerability due to [user-provided value](1).
router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
w.Header().Set("Content-Type", "text/html")
value := r.URL.Query().Get("id")
fmt.Fprintf(w, "This is test matcher text: %v", value)

Check warning

Code scanning / CodeQL

Reflected cross-site scripting

Cross-site scripting vulnerability due to [user-provided value](1).
router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
w.Header().Set("Content-Type", "text/html")
value := r.URL.Query().Get("id")
fmt.Fprintf(w, "This is test matcher text: %v", value)

Check warning

Code scanning / CodeQL

Reflected cross-site scripting

Cross-site scripting vulnerability due to [user-provided value](1).
@ehsandeep ehsandeep merged commit 572c8eb into dev Mar 6, 2023
@ehsandeep ehsandeep deleted the issue_2987_fuzz_options branch March 6, 2023 11:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add new cli parameters to override fuzzing type and fuzzing mode from cli
4 participants