nuclei

Documentation

Index

• func SetInteractshProvider(p InteractshProvider)
• type Classification
• type Extractor
• type Info
• type InteractshProvider
• type Matcher
• type Request
• type Result
  • func Execute(t *Template, baseURL string, timeout int, proxy string) *Result
• type StringOrSlice
  • func (s StringOrSlice) String() string
  • func (s *StringOrSlice) UnmarshalYAML(value *yaml.Node) error
• type Template
  • func LoadTemplate(path string) (*Template, error)
  • func LoadTemplates(dir string, tags string, severity string) ([]*Template, error)
  • func (t *Template) AllRequests() []Request
  • func (t *Template) CheckCapability() (string, bool)

Functions

func SetInteractshProvider

func SetInteractshProvider(p InteractshProvider)

SetInteractshProvider wires an OOB provider into the nuclei engine.

Types

type Classification

type Classification struct {
	CVEID       StringOrSlice `yaml:"cve-id"`
	CWEID       StringOrSlice `yaml:"cwe-id"`
	CVSSMetrics string        `yaml:"cvss-metrics"`
	CVSSScore   float64       `yaml:"cvss-score"`
}

Classification carries CVE/CWE/CVSS metadata.

type Extractor

type Extractor struct {
	Type     string   `yaml:"type"`
	Name     string   `yaml:"name"`
	Regex    []string `yaml:"regex"`
	Group    int      `yaml:"group"`
	KVal     []string `yaml:"kval"`
	JSON     []string `yaml:"json"`
	XPath    []string `yaml:"xpath"`
	DSL      []string `yaml:"dsl"`
	Part     string   `yaml:"part"`
	Internal bool     `yaml:"internal"`
}

type Info

type Info struct {
	Name           string         `yaml:"name"`
	Author         string         `yaml:"author"`
	Severity       string         `yaml:"severity"`
	Description    string         `yaml:"description"`
	Tags           StringOrSlice  `yaml:"tags"`
	Reference      StringOrSlice  `yaml:"reference"`
	Classification Classification `yaml:"classification"`
	Metadata       map[string]any `yaml:"metadata"`
}

type InteractshProvider

type InteractshProvider interface {
	// NewURL returns a correlation id and the full callback host/URL to embed.
	NewURL() (id string, fullURL string)
	// Poll reports whether a callback was received for id and its protocol
	// ("http"/"dns"), request text, and response text.
	Poll(id string) (proto string, request string, got bool)
}

InteractshProvider abstracts the OOB server so the nuclei engine can mint unique interactsh URLs and correlate callbacks without importing the oob package directly (avoids tight coupling; wired in cmd).

type Matcher

type Matcher struct {
	Type            string   `yaml:"type"`
	Words           []string `yaml:"words"`
	Regex           []string `yaml:"regex"`
	Status          []int    `yaml:"status"`
	Size            []int    `yaml:"size"`
	Binary          []string `yaml:"binary"`
	DSL             []string `yaml:"dsl"`
	XPath           []string `yaml:"xpath"`
	Part            string   `yaml:"part"`
	Condition       string   `yaml:"condition"`
	Negative        bool     `yaml:"negative"`
	CaseInsensitive bool     `yaml:"case-insensitive"`
	MatchAll        bool     `yaml:"match-all"`
	Internal        bool     `yaml:"internal"`
	Encoding        string   `yaml:"encoding"`
	Group           int      `yaml:"group"`
}

type Request

type Request struct {
	Method            string                 `yaml:"method"`
	Path              []string               `yaml:"path"`
	Raw               []string               `yaml:"raw"`
	Headers           map[string]string      `yaml:"headers"`
	Body              string                 `yaml:"body"`
	Attack            string                 `yaml:"attack"`
	Payloads          map[string]interface{} `yaml:"payloads"`
	Matchers          []Matcher              `yaml:"matchers"`
	MatchersCondition string                 `yaml:"matchers-condition"`
	Extractors        []Extractor            `yaml:"extractors"`
	ReqCondition      bool                   `yaml:"req-condition"`
	StopAtFirstMatch  bool                   `yaml:"stop-at-first-match"`
	Redirects         bool                   `yaml:"redirects"`
	HostRedirects     bool                   `yaml:"host-redirects"`
	MaxRedirects      int                    `yaml:"max-redirects"`
	CookieReuse       bool                   `yaml:"cookie-reuse"`
	Unsafe            bool                   `yaml:"unsafe"`
	Pipeline          bool                   `yaml:"pipeline"`
	IterateAll        bool                   `yaml:"iterate-all"`
	SkipVarCheck      bool                   `yaml:"skip-variables-check"`
}

type Result

type Result struct {
	TemplateID string
	Name       string
	Severity   string
	Matched    bool
	URL        string
	MatchedAt  string
	Evidence   string
	// Classification metadata (Phase 1 / G7)
	CVEID string
	CWEID string
	CVSS  float64
	Tags  []string
	// Capability gating (G9)
	Skipped       bool
	SkipReason    string
	ExtractedVars map[string]string
}

Result of a template execution

func Execute

func Execute(t *Template, baseURL string, timeout int, proxy string) *Result

Execute runs a template against a target URL. Backward compatible signature.

type StringOrSlice

type StringOrSlice []string

StringOrSlice accepts a YAML field that may be a string or a list of strings.

func (StringOrSlice) String

func (s StringOrSlice) String() string

String returns the values joined by comma (for legacy comparisons).

func (*StringOrSlice) UnmarshalYAML

func (s *StringOrSlice) UnmarshalYAML(value *yaml.Node) error

type Template

type Template struct {
	ID             string      `yaml:"id"`
	Info           Info        `yaml:"info"`
	Requests       []Request   `yaml:"http"`      // primary key
	RequestsLegacy []Request   `yaml:"requests"`  // legacy alias of http
	Variables      yaml.Node   `yaml:"variables"` // ordered, DSL-evaluable
	DNS            []yaml.Node `yaml:"dns"`
	TCP            []yaml.Node `yaml:"tcp"`
	SSL            []yaml.Node `yaml:"ssl"`
	File           []yaml.Node `yaml:"file"`
	Headless       []yaml.Node `yaml:"headless"`
	Code           []yaml.Node `yaml:"code"`
	JavaScript     []yaml.Node `yaml:"javascript"`
	Flow           string      `yaml:"flow"`
	SelfContained  bool        `yaml:"self-contained"`
}

Template represents a nuclei template. Fields are a superset of the schema; unsupported protocol blocks are parsed so we can gate on them (G9).

func LoadTemplate

func LoadTemplate(path string) (*Template, error)

LoadTemplate parses a single nuclei template file

func LoadTemplates

func LoadTemplates(dir string, tags string, severity string) ([]*Template, error)

LoadTemplates loads all templates from a directory (recursive)

func (*Template) AllRequests

func (t *Template) AllRequests() []Request

AllRequests returns the http requests, honoring both `http:` and `requests:`.

func (*Template) CheckCapability

func (t *Template) CheckCapability() (string, bool)

CheckCapability returns ("", true) if the template is fully supported, or a reason and false if it must be skipped.