Bumps clistats, fastdialer, retryablehttp-go, dsl, networkpolicy,
ratelimit, sarif, utils, wappalyzergo, cdncheck. dsl v0.8.18 moves to
the projectdiscovery/govaluate fork, and utils v0.11.0 pulls aurora v4,
so the corresponding imports and type references are migrated.
Refs #7380.
* fix(fuzz): prevent path mutation across sequential Rebuild calls (#6398)
retryablehttp.Request.Clone() shares the URL pointer, so when
Rebuild() calls UpdateRelPath() on the cloned request it mutates
q.req.URL.Path. On subsequent Rebuild() calls the original path
segments are wrong, causing corrupted fuzz requests (especially
visible with numeric path parts like /user/55/profile).
Snapshot the original path during Parse() and use the snapshot in
Rebuild() instead of reading from the mutable request.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* remove embedded URL field
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
Implements context-aware XSS reflection analysis for the nuclei fuzzing
engine, addressing issue #5838. Uses golang.org/x/net/html tokenizer
for robust context detection across 8 injection contexts including
javascript: URIs, non-executable script blocks, srcdoc attributes,
event handlers, style blocks, and HTML comments.
All 48 tests pass with comprehensive table-driven coverage including
malformed HTML, empty inputs, and case-insensitive matching.
Zero modifications to existing files.
The time_delay analyzer's reqSender rebuilt follow-up requests from
gr.Component.Rebuild() which clones the component's base request. That
base request is parsed from rule.BaseRequest *before* post-parse header
injection happens (custom -H flags, auth provider headers, cookies).
As a result every follow-up request was sent without the headers that the
original triggering request carried, including Cookie/Authorization —
the server rejected them or ran the SQL in an unauthenticated context.
Fix: after Rebuild(), copy the complete header set from gr.Request (the
original fuzz-generated request, which has all headers) into the rebuilt
request. This mirrors the same approach used everywhere else in the
request pipeline and makes the time_delay analyzer behave consistently.
Fixes#7106
Clone the data map before modification to prevent race conditions when
multiple goroutines call evaluateVarsWithInteractsh concurrently with
a shared map.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Continue the fix from #6666 by converting
remaining direct Body assignments to use setter
methods:
* pkg/fuzz/component/body.go:139: use
`SetBodyReader()` in transfer-encoding path.
* pkg/protocols/http/request.go:694: use
`SetBodyString()` in fuzz component `Rebuild()`.
Fixes#6692.
Signed-off-by: Dwi Siswanto <git@dw1.io>
* fix: remove undefined errorutil.ShowStackTrace
* feat: add make lint support and integrate with test
* refactor: migrate errorutil to errkit across codebase
- Replace deprecated errorutil with modern errkit
- Convert error declarations from var to func for better compatibility
- Fix all SA1019 deprecation warnings
- Maintain error chain support and stack traces
* fix: improve DNS test reliability using Google DNS
- Configure test to use Google DNS (8.8.8.8) for stability
- Fix nil pointer issue in DNS client initialization
- Keep production defaults unchanged
* fixing logic
* removing unwanted branches in makefile
---------
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
* feat: added fuzzing output enhancements
* changes as requested
* misc
* feat: added dfp flag to display fuzz points + misc additions
* feat: added support for fuzzing nested path segments
* feat: added parts to fuzzing requests
* feat: added tracking for parameter occurence frequency in fuzzing
* added cli flag for fuzz frequency
* fixed broken tests
* fixed path based sqli integration test
* feat: added configurable fuzzing aggression level for payloads
* fixed failing test
* feat: added analyzers implementation for fuzzing
* feat: misc changes to analyzer
* feat: misc additions of units + tests fix
* misc changes to implementation
* feat: added fuzzing output enhancements
* changes as requested
* misc
* feat: added dfp flag to display fuzz points + misc additions
* feat: added support for fuzzing nested path segments
* feat: added parts to fuzzing requests
* feat: added tracking for parameter occurence frequency in fuzzing
* added cli flag for fuzz frequency
* fixed broken tests
* fixed path based sqli integration test
* feat: added configurable fuzzing aggression level for payloads
* fixed failing test
* add default get method
* remove residual payload logic from old implementation
* fuzz: clone current state of component
* fuzz: bug fix stacking of payloads in multiple mode
* improve stdout template loading stats
* stdout: force display warnings if no templates are loaded
* update flags in README.md
* quote non-ascii chars in extractor output
* aws request signature can only be used in signed & verified tmpls
* deprecate request signature
* remove logic related to deprecated fuzzing input
* update test to use ordered params
* fix interactsh-url lazy eval: #4946
* output: skip unnecessary updates when unescaping
* updates as per requested changes
Doğan Can Bakır