`ConnectSMBInfoMode` only tried SMBv1 when SMB2/3
negotiation failed so dual-stack servers could
report `SupportV1` as false even when SMBv1 was
enabled.
Run a same-target SMBv1 probe after successful
SMB2/3 negotiation and merge the support flag into
the returned log w/o changing the negotiated
SMB2/3 version.
Fixes#4832
Signed-off-by: Dwi Siswanto <git@dw1.io>
Prevent pooled and non-pooled goja runtimes from
being reused or cleaned up when the `RunProgram`
goroutine fails to exit after context cancellation
and `Interrupt()`. In that state, the goroutine
may still be mutating runtime state, so touching
the runtime/returning it to the pool can cause
fatal concurrent map access panics.
Add an explicit `errRuntimeTerminationTimeout`
path that abandons the runtime, keeps the related
concurrency slot reserved, and releases that slot
only from a reaper after the orphaned goroutine
exits. Preserve `errors.Is` compatibility with the
original context cancellation cause.
Keep normal cleanup behavior unchanged, including
callback panic cleanup, and add regression tests
for stuck-interrupt handling that verify runtime
abandonment and delayed slot release.
Fixes#7376
* fix race condition
* fixing review comments
* fix(js): defer runtime cleanup
When a runtime is abandoned, we must not touch the
goja runtime after `RunProgram` has exceeded the
interrupt grace period. At the same time, cleanup
still needs to run on every normal exit before
returning the runtime to the pool, including setup
callback panics.
Signed-off-by: Dwi Siswanto <git@dw1.io>
---------
Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Dwi Siswanto <git@dw1.io>
Bumps clistats, fastdialer, retryablehttp-go, dsl, networkpolicy,
ratelimit, sarif, utils, wappalyzergo, cdncheck. dsl v0.8.18 moves to
the projectdiscovery/govaluate fork, and utils v0.11.0 pulls aurora v4,
so the corresponding imports and type references are migrated.
Refs #7380.
Add shared auth, options, result, redaction, and
adapter support for GoExec-backed JavaScript
helpers, including:
* `nuclei/wmi`
* `nuclei/tsch`
* `nuclei/scmr`
* `nuclei/dcom`
through generated bindings, and register them with
the JS compiler.
Also make JS generators to skip internal helper
packages and test files.
Signed-off-by: Dwi Siswanto <git@dw1.io>
* Interrupt goja runtime on context cancel
* undo import formats
* do both actions in same go-routine to prevent any possible race condition
* Convert the watchdog, into a simpeler construction which still guarantees the same promises
* move the recover to the go routine, and return named return since we now can use the channel
* remove unnecessary tests
* add extra safety in case process refuses to get interrupted
* remove unnecessary ExecFuncWithTwoReturns
* remove named return values
* fix(js): respect `allow-local-file-access` in `require`
The goja `require() `function used the default
host filesystem loader which let JavaScript
templates import any local files even when
`allow-local-file-access` was disabled.
Pooled runtimes kept `require()` state around so
a module loaded during a privileged execution
could remain cached for a later restricted one.
Rebuild the require registry per execution after
setting the execution context, and route file-
backed module loads to preserve native modules
while enforcing the same sandbox rules (as
`nuclei/fs`).
Signed-off-by: Dwi Siswanto <git@dw1.io>
* fix: cross-platform sandbox path checks
Replace lexical prefix checks in the template file
sandbox with a shared path containment helper that
canonicalizes both paths before comparing them to
prevent false rejections when the configured
templates directory and the resolved file path
differ only due to symlink expansion on macOS or
path normalization on Windows.
Apply the helper in `protocolstate.NormalizePath()`
and `Options.GetValidAbsPath()` so JS `require()`-
based module loads and helper file resolution use
the same rules.
Signed-off-by: Dwi Siswanto <git@dw1.io>
---------
Signed-off-by: Dwi Siswanto <git@dw1.io>
* fix(js): prevent pool slot starvation under load
Zombie goroutines from timed-out JS executions held pool slots
indefinitely: Add() blocked with context.Background(), and defer Done()
only ran when the goroutine eventually completed. Under load, both
pools (80 pooled + 20 non-pooled slots) filled with zombies, silently
dropping all subsequent matches.
Three changes fix slot lifecycle management:
1. Propagate the 20s deadline context into ExecuteProgram (compiler.go)
so both execution paths can respect the deadline.
2. Replace Add() with AddWithContext(ctx) in both pool.go and
non-pool.go so goroutines waiting for a slot fail fast when the
deadline expires instead of blocking indefinitely.
3. Add a watchdog goroutine that releases the slot when the deadline
expires, even if the zombie is still running. An atomic.Bool
ensures exactly one Done() call between the watchdog and the
normal defer path.
* adding context
* refactor(js): derived the ctx to remaining tractable deadline leaks (#7302)
* refactor(js): use `context.Background` as default instead
Signed-off-by: Dwi Siswanto <git@dw1.io>
* refactor(js): derived the ctx to remaining tractable deadline leaks
Signed-off-by: Dwi Siswanto <git@dw1.io>
* test(js): add `NucleiJS.Context` tests
Signed-off-by: Dwi Siswanto <git@dw1.io>
* fix(cmd): context param exclusion in memoization hash
The memoization template condition for excluding
context parameters from hash keys was incorrect.
The memoize package represents context.Context
types as "&{context Context}" (AST string
representation), not "context.Context".
Signed-off-by: Dwi Siswanto <git@dw1.io>
* chore(js): memogen'ed
Signed-off-by: Dwi Siswanto <git@dw1.io>
---------
Signed-off-by: Dwi Siswanto <git@dw1.io>
* fix(js): hangs in checkRDPEncryption
by bounding socket I/O
Add `setConnDeadlineFromContext` helper to set
deadlines on conns derived from context timeouts.
Move conn cleanup out of loop-scoped defers to
make sure immediate cleanup per probe attempt.
Signed-off-by: Dwi Siswanto <git@dw1.io>
---------
Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Niek den Breeje <AuditeMarlow@users.noreply.github.com>
Co-authored-by: Dwi Siswanto <25837540+dwisiswant0@users.noreply.github.com>
Co-authored-by: Dwi Siswanto <git@dw1.io>
Replace insecure math/rand PRNG with crypto/rand in Rand() and
RandInt() JavaScript helper functions. math/rand is predictable
and unsuitable when these functions are used for generating
security-sensitive values like tokens or nonces in templates.
* adding min auth support
* adding unauth list modules + auth list files in module
* example
* adding rsync test
* bump go.mod
---------
Co-authored-by: Dwi Siswanto <git@dw1.io>
The `connectWithDSN` func used `db.Exec()` which
implicitly uses `context.Background()`[1]. This
caused the registered "nucleitcp" dialer
callback to receive a ctx missing the
`executionId`, leading to a panic during type
assertion.
Refactor `connectWithDSN` to accept `executionId`
explicitly and use it to create a `context` for
`db.PingContext()` (yeah, instead of `db.Exec()`).
And, add a defensive check in the dialer callback
to handle nil values gracefully.
Fixes#6733 regression introduced in #6296.
[1]: "Exec uses `context.Background` internally" -
https://pkg.go.dev/database/sql#DB.Exec.
Signed-off-by: Dwi Siswanto <git@dw1.io>
Make sure postgres Exec/ExecContext are invoked with the correct
argument order, preventing context from being passed as the query.
* fixing pg syntax
* adding test
by:
* implement regex-based prompt matching for
password variants.
* add support for filling username prompts in
keyboard interactive challenges.
* improve debug logging with structured output.
this addresses issues with servers using
non-standard prompt formats and provides better
visibility into auth failures.
Signed-off-by: Dwi Siswanto <git@dw1.io>
* fix: remove undefined errorutil.ShowStackTrace
* feat: add make lint support and integrate with test
* refactor: migrate errorutil to errkit across codebase
- Replace deprecated errorutil with modern errkit
- Convert error declarations from var to func for better compatibility
- Fix all SA1019 deprecation warnings
- Maintain error chain support and stack traces
* fix: improve DNS test reliability using Google DNS
- Configure test to use Google DNS (8.8.8.8) for stability
- Fix nil pointer issue in DNS client initialization
- Keep production defaults unchanged
* fixing logic
* removing unwanted branches in makefile
---------
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
Dwi Siswanto