Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: added fuzzing output enhancements #5126

Merged
merged 3 commits into from
May 3, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion pkg/fuzz/execute.go
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,8 @@ type GeneratedRequest struct {
DynamicValues map[string]interface{}
// Component is the component for the request
Component component.Component
// Parameter being fuzzed
Parameter string
}

// Execute executes a fuzzing rule accepting a callback on which
Expand Down Expand Up @@ -223,7 +225,7 @@ func (rule *Rule) executeRuleValues(input *ExecuteRuleInput, ruleComponent compo
if err != nil {
return err
}
if gotErr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent); gotErr != nil {
if gotErr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, ""); gotErr != nil {
return gotErr
}
}
Expand Down
9 changes: 5 additions & 4 deletions pkg/fuzz/parts.go
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ func (rule *Rule) executePartComponentOnValues(input *ExecuteRuleInput, payloadS
return err
}

if qerr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent); qerr != nil {
if qerr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, key); qerr != nil {
return qerr
}
// fmt.Printf("executed with value: %s\n", evaluated)
Expand All @@ -90,7 +90,7 @@ func (rule *Rule) executePartComponentOnValues(input *ExecuteRuleInput, payloadS
if err != nil {
return err
}
if qerr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent); qerr != nil {
if qerr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, ""); qerr != nil {
err = qerr
return err
}
Expand Down Expand Up @@ -125,7 +125,7 @@ func (rule *Rule) executePartComponentOnKV(input *ExecuteRuleInput, payload Valu
return err
}

if qerr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent); qerr != nil {
if qerr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, key); qerr != nil {
return err
}

Expand All @@ -144,12 +144,13 @@ func (rule *Rule) executePartComponentOnKV(input *ExecuteRuleInput, payload Valu
}

// execWithInput executes a rule with input via callback
func (rule *Rule) execWithInput(input *ExecuteRuleInput, httpReq *retryablehttp.Request, interactURLs []string, component component.Component) error {
func (rule *Rule) execWithInput(input *ExecuteRuleInput, httpReq *retryablehttp.Request, interactURLs []string, component component.Component, parameter string) error {
request := GeneratedRequest{
Request: httpReq,
InteractURLs: interactURLs,
DynamicValues: input.Values,
Component: component,
Parameter: parameter,
}
if !input.Callback(request) {
return types.ErrNoMoreRequests
Expand Down
16 changes: 16 additions & 0 deletions pkg/output/format_screen.go
Original file line number Diff line number Diff line change
Expand Up @@ -106,5 +106,21 @@ func (w *StandardWriter) formatScreen(output *ResultEvent) []byte {
}
builder.WriteString("]")
}

// If it is a fuzzing output, enrich with additional
// metadata for the match.
if output.IsFuzzingResult {
if output.FuzzingParameter != "" {
builder.WriteString(" [")
builder.WriteString(output.FuzzingPosition)
builder.WriteRune(':')
builder.WriteString(w.aurora.BrightMagenta(output.FuzzingParameter).String())
builder.WriteString("]")
}

builder.WriteString(" [")
builder.WriteString(output.FuzzingMethod)
builder.WriteString("]")
}
return builder.Bytes()
}
8 changes: 8 additions & 0 deletions pkg/output/output.go
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,14 @@ type ResultEvent struct {
// must be enabled by setting protocols.ExecuterOptions.ExportReqURLPattern to true
ReqURLPattern string `json:"req_url_pattern,omitempty"`

// Fields related to HTTP Fuzzing functionality of nuclei.
// The output contains additional fields when the result is
// for a fuzzing template.
IsFuzzingResult bool `json:"is_fuzzing_result,omitempty"`
FuzzingMethod string `json:"fuzzing_method,omitempty"`
FuzzingParameter string `json:"fuzzing_parameter,omitempty"`
FuzzingPosition string `json:"fuzzing_position,omitempty"`

FileToIndexPosition map[string]int `json:"-"`
Error string `json:"error,omitempty"`
}
Expand Down
7 changes: 7 additions & 0 deletions pkg/protocols/http/request_fuzz.go
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,13 @@ func (request *Request) executeGeneratedFuzzingRequest(gr fuzz.GeneratedRequest,
}
var gotMatches bool
requestErr := request.executeRequest(input, req, gr.DynamicValues, hasInteractMatchers, func(event *output.InternalWrappedEvent) {
for _, result := range event.Results {
result.IsFuzzingResult = true
result.FuzzingMethod = gr.Request.Method
result.FuzzingParameter = gr.Parameter
result.FuzzingPosition = gr.Component.Name()
}

if hasInteractMarkers && hasInteractMatchers && request.options.Interactsh != nil {
requestData := &interactsh.RequestData{
MakeResultFunc: request.MakeResultEvent,
Expand Down
Loading