How to match across multiple requests?

[mikerott]

I need to check two different endpoints at a server to:

1. match the version number of a "meta" HTML tag, and
2. check if the server is vulnerable by attempting the basic exploit (basically, a well-formed query param resulting in remote code execution)

How can I write a template such that the matchers under each request are "and"ed?

Example (pseudo-code) attempt:

requests:
  - method: GET
    redirects: true
    path:
      - "{{RootURL}}/vulnerable/index.php?queryparam=exec(whoami)"

    matchers:
      - type: word
        words:
          - "X-Proof-Of-Vuln: root"
        part: header

  - method: GET
    redirects: true
    path:
      - "{{RootURL}}/"

    matchers:
      - type: regex
        regex: # versions 1.0 through 1.4
          - '<meta name="version" content="(1\.[0-4].*)">'
        part: body
        condition: and # must match above matcher _and_ this one

I want the two matchers to be AND, even though I've made two requests to acquire the full set of conditions. For example, version 1.4.2 may be patched manually, in which case it would match the latter matcher, but not the former. In such a case, I want Nuclei to report "No results found."

[ehsandeep]

@mikerott below example should work, in this case matchers-condition: and will ensure to return results only when all conditions are true for all the defined requests.

requests:
  - method: GET
    path:
      - "{{RootURL}}/"
      - "{{RootURL}}/vulnerable/index.php?queryparam=exec(whoami)"

    redirects: true
    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "X-Proof-Of-Vuln: root"

      - type: regex
        part: body
        regex:
          - '<meta name="version" content="(1\.[0-4].*)">'

[mikerott]

@ehsandeep that suggestion did not work. I'm going to try the dsl matching with req-condition: true

The two endpoints in my case do not return the same response headers or payload, so "and"ing the matchers won't work, right? In other words, I need to treat my template _as though I'm "writing complex checks and exploits involving multiple HTTP request to complete the exploit chain"

[ehsandeep]

@mikerott as default matchers and conditions checks against all the requests and not per request, so it should work in general as soon as both matchers are available in any response, you can definitely write more complex template using request condition to write per response matcher.

Feel free to dm me on discord https://discord.gg/projectdiscovery (pdteam) if you have more details to share.

[mikerott]

Ok, I wrote up a simple test. I made an nginx server like:

        location /first {
            return 200 '1st';
            add_header Content-Type text/plain;
        }

        location /second {
            return 200 '2nd';
            add_header Content-Type text/plain;
        }

And a Nuclei template like this:

requests:
  - method: GET
    redirects: true
    path:
      - "{{RootURL}}/first"
      - "{{RootURL}}/second"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "1st"
        part: body
      - type: word
        words:
          - "2nd"
        part: body

I get no results:

[INF] Templates loaded for scan: 1
[VER] [hot-vuln] Sent HTTP request to http://localhost/first
[VER] [hot-vuln] Sent HTTP request to http://localhost/second
[INF] No results found. Better luck next time!

If I change the template to:

requests:
  - method: GET
    redirects: true
    path:
      - "{{RootURL}}/first"
    matchers:
      - type: word
        words:
          - "1st"
        part: body
  - method: GET
    redirects: true
    path:
      - "{{RootURL}}/second"
    matchers:
      - type: word
        words:
          - "2nd"
        part: body

Then I get two hits:

[INF] Templates loaded for scan: 1
[VER] [hot-vuln] Sent HTTP request to http://localhost/first
[2022-06-04 13:03:10] [hot-vuln] [http] [] http://localhost/first
[VER] [hot-vuln] Sent HTTP request to http://localhost/second
[2022-06-04 13:03:10] [hot-vuln] [http] [] http://localhost/second

If I change the nginx server such that GET /first response body does not match the template, I still get a hit:

[INF] Templates loaded for scan: 1
[VER] [hot-vuln] Sent HTTP request to http://localhost/first
[VER] [hot-vuln] Sent HTTP request to http://localhost/second
[2022-06-04 13:06:22] [hot-vuln] [http] [] http://localhost/second

...which I do not want.

How can I arrange the template such that both conditions must be met?

[ehsandeep]

@mikerott thanks for sharing the details and using request condition is option in this case, for example:

id: basic-example

info:
  name: Test HTTP Template
  author: pdteam
  severity: info

requests:
  - method: GET
    path:
      - "{{RootURL}}/first"
      - "{{RootURL}}/second"

    req-condition: true
    redirects: true
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Example Domain"
        part: body_1

      - type: word
        words:
          - "Not Found"
        part: body_2

echo https://example.com | nuclei -t test.yaml

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   2.7.1

		projectdiscovery.io

[WRN] Use with caution. You are responsible for your actions.
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[INF] Using Nuclei Engine 2.7.1 (latest)
[INF] Using Nuclei Templates 9.0.6 (latest)
[INF] Templates added in last update: 0
[INF] Templates loaded for scan: 1
[basic-example] [http] [info] https://example.com/second

more similar examples: https://github.com/projectdiscovery/nuclei-templates/search?q=req-condition

[mikerott]

That is perfect. Worked great. Thank you so so much @ehsandeep !!