nuclei
nuclei copied to clipboard
Expand the cookie JAR across workflows
Scenario: create a workflow that starts with a template that logs in to an application, and then all the subsequent templates would automatically contain the session cookies.
General implementation notes:
- The workflow should instantiate a cookie jar instance before starting the execution
- The templates part of the workflow should be provided with the shared cookie jar that the respective retryablehttp client will use
- Templates within a workflow involving a cookie jar should probably not be clustered to avoid leaking cookies to other execution contexts
- It might be necessary to introduce conditional flow/execution order: for example, executing the login template, checking on its results, and then proceeding with further exploitation
Options to consider:
- Global scenario:
cookie-reuse: true # all templates within this workflow can read and modify cookies
workflows:
- template: a.yaml # e.g. this templates creates a JWT with a timestamp
- subtemplates:
- template: b.yaml # the first request in this template uses the existing JWT and then updates the timestamp
- template: c.yaml # requests within this template receive the updated JWT
- Restricted:
workflows:
- template: a.yaml
cookie-reuse: true # cookies set by the "a" template are READ-ONLY and restricted to subtemplates only
- subtemplates:
- template: b.yaml
- template: c.yaml