admin/projectdiscovery-nuclei
1
0
Fork 0
mirror of https://github.com/projectdiscovery/nuclei synced 2026-06-08 16:50:47 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,670 Commits 66 Branches 143 Tags
4ff80784aed47212cb27c474eaad45f9ceed05ab
Commit Graph

547 Commits

Author SHA1 Message Date
曹家巧 4ff80784ae refactor: use the built-in max/min to simplify the code (#6272) 
Signed-off-by: xiaoxiangirl <caojiaqiao@outlook.com>
 2025-06-24 05:49:06 +05:30
Dwi Siswanto 695a7520b9 fix(headless): incorrect last navigated URL (#6278) 
* chore(headless): uses `maps.Copy`

Signed-off-by: Dwi Siswanto <git@dw1.io>

* feat(headless): implements update last navigated URL

for `ActionNavigate`, `WaitPageLifecycleEvent`, and
`WaitStable` based on latest navigation URL.

Signed-off-by: Dwi Siswanto <git@dw1.io>

* Update pkg/protocols/headless/engine/page.go

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
 2025-06-24 05:32:18 +05:30
Nakul Bharti c242b112cc fixed hex dump issue (#6273) 2025-06-19 20:07:59 +05:30
knakul853 aba8c47e10 fixed log level mismatch 2025-06-17 17:02:57 +05:30
sandeep 5af6feb889 version update 2025-06-17 05:12:02 +05:30
Dwi Siswanto 61bcf0f10e feat(headless): store responses (#6247) 
Signed-off-by: Dwi Siswanto <git@dw1.io>
 2025-06-17 05:00:31 +05:30
Dwi Siswanto a326f3925c fix(tmplexec): memory blowup in multiproto (#6258) 
* bugfix: fix memory blowup using previousEvent for multi-proto execution

* refactor(tmplexec): uses supported protocol types

Signed-off-by: Dwi Siswanto <git@dw1.io>

* add co-author

Co-authored-by: Nakul Bharti <knakul853@users.noreply.github.com>
Signed-off-by: Dwi Siswanto <git@dw1.io>

* refactor(tmplexec): mv builder inside loop scope

Signed-off-by: Dwi Siswanto <git@dw1.io>

* refactor(tmplexec): skip existing keys in `FillPreviousEvent`

The `FillPreviousEvent` func was modified to
prevent overwriting/duplicating entries in the
previous map.

It now checks if a key `k` from
`event.InternalEvent` already exists in the
previous map. If it does, the key is skipped. This
ensures that if `k` was already set (potentially
w/o a prefix), it's not re-added with an `ID_`
prefix.

Additionally, keys in `event.InternalEvent` that
already start with the current `ID_` prefix are
also skipped to avoid redundant prefixing.

This change simplifies the logic by removing the
`reqTypeWithIndexRegex` and directly addresses the
potential for duplicate / incorrectly prefixed
keys when `event.InternalEvent` grows during
protocol request execution.

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore(tmplexec): naming convention, `ID` => `protoID`

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore(tmplexec): it's request ID lol sorry

Signed-off-by: Dwi Siswanto <git@dw1.io>

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Ice3man <nizamulrana@gmail.com>
Co-authored-by: Nakul Bharti <knakul853@users.noreply.github.com>
 2025-06-17 04:53:32 +05:30
Dwi Siswanto 797ceb57db fix(authx): JSON unmarshalling for Dynamic auth type (#6268) 
* fix(authx): JSON unmarshalling for Dynamic auth type

Correcting the `UnmarshalJSON` method to properly
unmarshal JSON, particularlyaddressing the
population of the embedded `Secret` field. This
was achieved by using a type alias to avoid
recursive calls and rely on default unmarshalling
behavior.

Signed-off-by: Dwi Siswanto <git@dw1.io>

* feat(authx): adds nil Dynamic struct check

Signed-off-by: Dwi Siswanto <git@dw1.io>

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
 2025-06-17 04:48:05 +05:30
Shubham Rasal f89a6d33e9 Use proxy for dns and ssl templates (#6255) 
* Use proxy for dns and ssl templates

- while using template execute level function we need to override custom dialer

* rename overridedialer to customdialer

* Add proxy into hash

- proxy client is shared between non proxy requests

* add dialer into request object

- use request.dialer instead of global variable

* resolve comments

* rename dialer
 2025-06-16 22:24:52 +05:30
sandeep fc6d5a7773 improved logging 2025-06-16 20:06:17 +05:30
tongjicoder 3be29abfc9 refactor: use slices.Contains to simplify code 
Signed-off-by: tongjicoder <tongjicoder@icloud.com>
 2025-05-27 17:16:26 +08:00
Dogan Can Bakir 160eab998c Merge pull request #6222 from fourcube/fix/slow-headless-start-and-shutdown 
fix: improve headless engine startup and shutdown
 2025-05-19 16:42:38 +03:00
Dwi Siswanto 3957237199 fix(openapi): handles nil schema & schema values (#6228) 
Signed-off-by: Dwi Siswanto <git@dw1.io>
 2025-05-17 00:46:41 +05:30
Doğan Can Bakır 2c1cd27e2c update version 2025-05-15 19:42:20 +07:00
circleous b03c30418b fix: fallback set SNI to host if not specified when using socks proxy (#6218) 2025-05-15 16:46:49 +05:30
Chris Grieger bc551fc3f1 fix: improve headless engine startup and shutdown 
Fixes #6221

Instead of enumerating all chrome processes to determine
which ones need to be killed on shutdown, use the launcher.Kill()
method to terminate the process that was launched for this
browser instance.
 2025-05-14 16:14:21 +02:00
sandeep 6d25a5c8ca version update 2025-05-08 19:02:47 +05:30
Sandeep Singh 4801cc65ef feat: fixed max-host-error blocking + progress mismatch + misc (#6193) 
* feat: fixed max-host-error blocking wrong port for template with error

* feat: log total results with time taken at end of execution

* bugfix: skip non-executed requests with progress in flow protocol

* feat: fixed request calculation in http protocol for progress

* misc adjustments

---------

Co-authored-by: Ice3man <nizamulrana@gmail.com>
 2025-05-07 17:22:15 +05:30
Mzack9999 b9d0f2585f Merge pull request #6200 from projectdiscovery/msssql-exec-query-support 
feat: added support to mssql for execute query
 2025-05-01 23:19:03 +02:00
Mzack9999 088425d351 adding mssql check 2025-05-01 22:44:29 +02:00
pussycat0x cbf57ef889 Update ldap.go (#6202) 2025-04-30 14:10:44 +05:30
Ice3man b14e634047 feat: added support to mssql for execute query 2025-04-28 18:56:35 +05:30
Dogan Can Bakir ffb0a92216 Merge pull request #6088 from projectdiscovery/fix_interactsh_for_js 
fix unresolved `interactsh-url` for js templates
 2025-04-17 11:03:32 +03:00
Florian Pfitzer c0b5c29d3b fix: default offlinehttp extractor without part to body like requests 2025-04-14 09:13:11 +02:00
Ice3man b47ce6c372 feat: added bearer support to jira reporting for self hosted + misc 2025-04-03 16:52:57 +05:30
Doğan Can Bakır 59bc570a93 update version 2025-03-30 19:40:39 +05:30
alingse e88c59f7ea fix call errors.Wrap with a nil value error err 
it should call errors.Wrap(writeErr, ...
 2025-03-29 23:15:21 +08:00
Doğan Can Bakır 3307ce5ae8 update version 2025-03-28 13:20:29 +05:30
Doğan Can Bakır 6f6d4ae79f update version 2025-03-26 15:46:48 +05:30
threehonor d1b1c23e4e chore: fix some function names in comment 
Signed-off-by: threehonor <pengqi@email.cn>
 2025-03-26 11:03:43 +08:00
alban.stourbe stourbe e35c6049bb Add loadConfig S3 based on AWS_PROFILE ~/.aws/credentials 2025-03-24 17:17:14 +01:00
Shubham Rasal 04a6c82730 add setDialer function to TCP protocol (#6101) 
- add ability to override setDialer function for tcp
- socks proxy is not used incase of tcp protocol
- TCP uses global tcp dialer shared, we need template request level ability to set dialer
 2025-03-17 16:44:33 +05:30
sandeep 0d6d50d980 version update 2025-03-07 23:06:42 +05:30
Dogan Can Bakir a9718d3664 set headers for fuzzing request (#5988) 
Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
 2025-03-07 20:54:35 +05:30
Nakul Bharti 1874d5b900 fix: prevent nil pointer dereference on context cancellation (#6085) 2025-03-07 20:34:27 +05:30
Ice3man d10b7f7382 feat: escape code blocks for markdown formatting (#6089) 2025-03-07 14:45:39 +05:30
Ice3man d56524933f feat: fix reporting close functionality + misc (#6066) 2025-03-06 22:49:21 +05:30
Doğan Can Bakır 1e08d29e50 fix unresolved interactsh-url for js templates 2025-03-06 15:52:12 +03:00
huochexizhan 3a3f5e271c fix: fix incorrect nil return value (#6079) 
Signed-off-by: huochexizhan <huochexizhan@outlook.com>
 2025-03-03 16:19:16 +05:30
Nakul Bharti fa7329f16e fix: race condition of the lastmatcherevent (#6080) 2025-03-03 16:10:12 +05:30
Dwi Siswanto 940885a3cc feat: generate CPU & PGO profiles (#6058) 
* feat: generate CPU profiles

also adjust memory (heap) profiles ext to `.mem`

Signed-off-by: Dwi Siswanto <git@dw1.io>

* docs(DESIGN): add total samples for CPU profiles

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore(make): trimpath in go-build

and append LDFLAGS ifneq "darwin"

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore: update goreleaser build

* replace `go mod tidy` with `go mod download` and
  `go mod verify`
* adjust indentations
* add `-trimpath` flag
* set `-pgo` flag to "`auto`"
* add `ldflags`
* quoting 386 GOARCH value

Signed-off-by: Dwi Siswanto <git@dw1.io>

* ci: add generate PGO workflow

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore(make): set CGO_ENABLED inline in go-build

Signed-off-by: Dwi Siswanto <git@dw1.io>

* refactor(main): streamline profile file creation

Signed-off-by: Dwi Siswanto <git@dw1.io>

* dummy: add PGO file (DO NOT MERGE)

Signed-off-by: Dwi Siswanto <git@dw1.io>

* feat: add main test (benchmark)

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore(make): add build-test

Signed-off-by: Dwi Siswanto <git@dw1.io>

* Revert "dummy: add PGO file (DO NOT MERGE)"

This reverts commit ee877205f729be2f054c7d7d484a9244121acce6.

* test(main): set Output to /dev/null

Signed-off-by: Dwi Siswanto <git@dw1.io>

* feat(output): add option to disable stdout via env var

Signed-off-by: Dwi Siswanto <git@dw1.io>

* test(main): set `types.Options.Output` to empty

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore(generate-pgo): add TODO note

Signed-off-by: Dwi Siswanto <git@dw1.io>

* ci: add reusable perf regression workflow

Signed-off-by: Dwi Siswanto <git@dw1.io>

* ci(perf-regression): enabe `DISABLE_STDOUT`

Signed-off-by: Dwi Siswanto <git@dw1.io>

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
 2025-02-24 16:52:57 +05:30
Dwi Siswanto 047d49f6f3 fix(json): update build constraints for Go version comp (#6064) 
Signed-off-by: Dwi Siswanto <git@dw1.io>
 2025-02-21 12:04:04 +05:30
Dogan Can Bakir cbd90df51c fix secrets lookup logic (#6059) 
* fix secrets lookup logic

* check len
 2025-02-20 06:01:24 +05:30
Ice3man dabcce865e feat: fixed stats not working + misc changes 2025-02-14 00:53:23 +05:30
Ice3man 5f0b7eb19b feat: added initial live DAST server implementation (#5772) 
* feat: added initial live DAST server implementation

* feat: more logging + misc additions

* feat: auth file support enhancements for more complex scenarios + misc

* feat: added io.Reader support to input providers for http

* feat: added stats db to fuzzing + use sdk for dast server + misc

* feat: more additions and enhancements

* misc changes to live server

* misc

* use utils pprof server

* feat: added simpler stats tracking system

* feat: fixed analyzer timeout issue + missing case fix

* misc changes fix

* feat: changed the logics a bit + misc changes and additions

* feat: re-added slope checks + misc

* feat: added baseline measurements for time based checks

* chore(server): fix typos

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* fix(templates): potential DOM XSS

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* fix(authx): potential NIL deref

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* feat: misc review changes

* removed debug logging

* feat: remove existing cookies only

* feat: lint fixes

* misc

* misc text update

* request endpoint update

* feat: added tracking for status code, waf-detection & grouped errors (#6028)

* feat: added tracking for status code, waf-detection & grouped errors

* lint error fixes

* feat: review changes + moving to package + misc

---------

Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>

* fix var dump (#5921)

* fix var dump

* fix dump test

* Added filename length restriction for debug mode (-srd flag) (#5931)

Co-authored-by: Andrey Matveenko <an.matveenko@vkteam.ru>

* more updates

* Update pkg/output/stats/waf/waf.go

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

---------

Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
Co-authored-by: Dwi Siswanto <25837540+dwisiswant0@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Dogan Can Bakir <65292895+dogancanbakir@users.noreply.github.com>
Co-authored-by: 9flowers <51699499+Lercas@users.noreply.github.com>
Co-authored-by: Andrey Matveenko <an.matveenko@vkteam.ru>
Co-authored-by: Sandeep Singh <sandeep@projectdiscovery.io>
 2025-02-13 18:46:28 +05:30
sandeep 31fb7c8963 Merge branch 'dev' of https://github.com/projectdiscovery/nuclei into dev 2025-02-13 17:50:34 +05:30
sandeep 027c393736 version update 2025-02-13 17:38:46 +05:30
9flowers ef11565bcb Added filename length restriction for debug mode (-srd flag) (#5931) 
Co-authored-by: Andrey Matveenko <an.matveenko@vkteam.ru>
 2025-02-13 17:20:56 +05:30
Dogan Can Bakir 3c825e8045 fix var dump (#5921) 
* fix var dump

* fix dump test
 2025-02-13 17:20:14 +05:30
Ice3man a2c8f1e4cd feat: added tracking for status code, waf-detection & grouped errors (#6028) 
* feat: added tracking for status code, waf-detection & grouped errors

* lint error fixes

* feat: review changes + moving to package + misc

---------

Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
 2025-02-13 17:13:39 +05:30