nuclei icon indicating copy to clipboard operation
nuclei copied to clipboard

Helper function for IP Formats

Open ehsandeep opened this issue 3 years ago • 4 comments

Please describe your feature request:

Helper function to support https://github.com/projectdiscovery/mapcidr#ip-formats

Describe the use case of this feature:

To write templates including IP in various formats to fuzz/bypass multiple IP-based protection.

id: basic-raw-example

info:
  name: Test RAW Template
  author: pdteam
  severity: info

requests:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{ips}}
        Origin: {{BaseURL}}

    payloads:
      ips:
        - "{{ip_format("127.0.1.0", 3)}}"
        - "{{ip_format("169.254.169.254", 4)}}"
        - "{{ip_format(ip, 4)}}"

ehsandeep avatar Jul 10 '22 22:07 ehsandeep

any chance to implement helper function too {{ip("domain.com")}} to get ip of domain.com

0xAwali avatar Jul 17 '22 15:07 0xAwali

@0xAwali do you mind sharing some use cases in the template of this?

ehsandeep avatar Jul 18 '22 10:07 ehsandeep

two cases one of them while bypassing 403 status code by using X-Forwards-For: {{ip("Host")}} not 127.0.0.1 e.g.

id: test

info:
  name: test template
  author: 0xAwali
  severity: info

requests:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-Forwards-For: {{ip("Host")}}

and the second is compare between request with hostname as Host header and IP as Host header to figure out target use vhosts or not

0xAwali avatar Jul 18 '22 12:07 0xAwali

thanks, added details here - https://github.com/projectdiscovery/nuclei/issues/2305

ehsandeep avatar Jul 18 '22 12:07 ehsandeep

@princechaddha New helpers include examples: please update documentation @Mzack9999 @ehsandeep Please add 'Type: Documentation' label if docs need updating

atdash avatar Sep 26 '22 17:09 atdash

This is for CIDR support? For IPv4 CIDR only or also IPv6 CIDR? The naming could be more specific instead of ip unless it's for both v4/v6. Also we need documentation for this.

JaneX8 avatar Dec 06 '22 13:12 JaneX8