nuclei icon indicating copy to clipboard operation
nuclei copied to clipboard

enable debugging/output of generated oob URLs for tracking

Open c-f opened this issue 4 years ago • 0 comments

Proposed changes

This PR adds a new flag and helps to correlate oob requests from Nuclei.

If the nuclei client did not pull the oob responses from the interactsh server, then no event is created and it's impossible to identify the origin nor request. Especially the correlation with the system is problematic if internal DNS log have identified vulnerable systems, but cannot correlate the request nor actor.

With the output of the generated URLs one can easily identify not only the system but can answer if the request were sent from you or not.

[INF] [CVE-2021-44228] Correlation for http://127.0.0.1:8009/log4jcanary
{"InteractshURLs":["<uuid>.interact.sh","<uuid>.interact.sh"],"ReqURL":"http://127.0.0.1:8009/log4jcanary","TemplateID":"CVE-2021-44228"}

Checklist

  • [x] Pull request is created against the dev branch
  • [x] All checks passed (lint, unit/integration/regression tests etc.) with my changes
  • [x] I have added tests that prove my fix is effective or that my feature works
  • [ ] I have added necessary documentation (if appropriate)

c-f avatar Dec 20 '21 15:12 c-f