Nuclei might be failing in this case

[iamxhunt3r]

Hey i was improving drupal login template exposed-panels/drupal-login.yaml

id: drupal-login

info:
  name: Drupal Login Panel - Detect
  author: pathtaga
  severity: info
  description: Drupal login panel was detected.
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 0.0
    cwe-id: CWE-200
  metadata:
    shodan-query: http.component:"drupal"
  tags: panel,drupal

requests:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/user/login"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Log in'
        condition: and

      - type: regex
        part: raw
        regex:
          - '<(?:link|style)[^>]+"/sites/(?:default|all)/(?:themes|modules)/'
          - '<[^>]+(?:id="block[_-]commerce[_-]cart[_-]cart|class="commerce[_-]product[_-]field)'
          - '(?i)x-drupal'
          - '(?i)x-generator: drupal'
        condition: or

When i check above template on lets say https://www.drupal.org/user/login it doesn't detect it.

But after replacing part: raw to part: header it works
Am i missing something, dont raw contains both header and body ?

[iamxhunt3r]

@ehsandeep

[ehsandeep]

@iamxhunt3r All the protocols have different part definitions, in this case part: raw is supported in dns and tcp protocol.

For http, you can use part: response if you are looking to match in http response body + header

You can also search for "Part Definitions" in https://github.com/projectdiscovery/nuclei/blob/main/SYNTAX-REFERENCE.md to learn more about the support part for each protocol.

id: drupal-login

info:
  name: Drupal Login Panel - Detect
  author: pathtaga
  severity: info
  description: Drupal login panel was detected.
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 0.0
    cwe-id: CWE-200
  metadata:
    shodan-query: http.component:"drupal"
  tags: panel,drupal

requests:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/user/login"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Log in'
        condition: and

      - type: regex
        part: response
        regex:
          - '<(?:link|style)[^>]+"/sites/(?:default|all)/(?:themes|modules)/'
          - '<[^>]+(?:id="block[_-]commerce[_-]cart[_-]cart|class="commerce[_-]product[_-]field)'
          - '(?i)x-drupal'
          - '(?i)x-generator: drupal'
        condition: or

[iamxhunt3r]

Thanks @ehsandeep