Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add new field 'port' in network protocol #4123

Merged
merged 5 commits into from
Sep 11, 2023
Merged

add new field 'port' in network protocol #4123

merged 5 commits into from
Sep 11, 2023

Conversation

tarunKoyalwar
Copy link
Member

@tarunKoyalwar tarunKoyalwar commented Sep 4, 2023

Proposed Changes

currently in network template to allow running template against a different port than one hardcoded in template (ref: https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2001/CVE-2001-1473.yaml)
and this is achieved by sending 2 requests

tcp:
  - host:
      - "{{Hostname}}"
      - "{{Host}}:22"

and this will always cause 1 requests to fail . currently there are more than 100 network templates so 100 requests will fail

in this PR we introduce port: 2345 <- port field in network template and this is considered as default/hardcoded port and it addresses mainly three cases

  • if port is not specified in input then default port i.e 2345 is used
  • if input is something like 'scanme.sh:443 or scanme.sh:8081' we use default port '2345' since network requests are usually (mostly) requested aganist non-http services

below contains port that are ignored
// reservedPorts contains list of reserved ports for non-network requests in nuclei
reservedPorts = []string{"80", "443", "8080", "8443", "8081", "53"}

  • if input port contains any non standard port like scanme.sh:3674 (i.e non http) then 3674 is used instead of hardcoded 2345

@tarunKoyalwar tarunKoyalwar self-assigned this Sep 4, 2023
@tarunKoyalwar tarunKoyalwar marked this pull request as ready for review September 4, 2023 17:05
@tarunKoyalwar
Copy link
Member Author

$ TESTS="network/network-port.yaml" ./run.sh
::group::Build nuclei
::endgroup::
::group::Build nuclei integration-test
::endgroup::
::group::Installing nuclei templates

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.13

		projectdiscovery.io

[INF] No new updates found for nuclei templates
::endgroup::
skipping test case http/interactsh.yaml. disabled on darwin.
skipping test case http/interactsh-stop-at-first-match.yaml. disabled on darwin.
skipping test case http/default-matcher-condition.yaml. disabled on darwin.
[✓] Test "network/network-port.yaml" passed!

@tarunKoyalwar
Copy link
Member Author

Example template

id: network-port-example

info:
  name: Example Template with Network Port
  author: pdteam
  severity: high
  description: This is an updated description for the network port example.
  reference: https://updated-reference-link

tcp:
  - host: 
      - "{{Hostname}}"
    port: 23846
    inputs:
      - data: "PING\r\n"
    read-size: 4
    matchers:
    - type: word
      part: data
      words:
        - "PONG"

@tarunKoyalwar tarunKoyalwar changed the title add reserved networkPort in template add new field 'port' in network protocol Sep 5, 2023
Copy link
Member

@Mzack9999 Mzack9999 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Implementation: lgtm
Notes:

  • Near impossible to write network templates towards http/https ports when different reserved port is defined (eg ssh with reserved port 22 but user input with custom port 80)
  • Would work very well with https://github.com/projectdiscovery/netdb for filtering ports:
exclude-ports: http,ftp

@tarunKoyalwar
Copy link
Member Author

New Changes

  • added exclude-ports option to overwrite default excluded ports
  • added documentation regarding 'port' and why it should be used / preferred

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Input handling for network templates
3 participants