nuclei

What's Changed

• Fixed an issue for templates with dynamic extractor + payloads edgecase by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/5016
• Fixed missing JSON schema definitions by @RamanaReddy0M in https://github.com/projectdiscovery/nuclei/pull/4995
• Fixed index out of range panic with fuzzing templates by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4998
• Fixed missing interactsh expression evaluation in fuzzing template by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/5019
• Fixed missing IP in javascript templates by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/5023
• Fixed invalid port in jsonl output for ssl templates by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/5023
• Added ASREProastable method in LDAP module by @daffainfo in https://github.com/projectdiscovery/nuclei/pull/4990

New Contributors

• @hanghuge made their first contribution in https://github.com/projectdiscovery/nuclei/pull/5004
• @daffainfo made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4990

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.2.3...v3.2.4

[!Important]
Nuclei Templates for dynamic application security testing (DAST), which were maintained in a separate project at fuzzing-templates, are now being moved to the nuclei-templates project. This way, they can be made available for use with the default nuclei installation with the upcoming release of the template project. These templates will be disabled as default but can be used with the -dast option.

More information of fuzzing support: https://blog.projectdiscovery.io/nuclei-fuzzing-for-unknown-vulnerabilities/

What's Changed

• Added -dast option to run all and only dast (fuzz) templates by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4941
• Added pre-condition attribute in Code and DAST templates by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4966
• Fixed multiple panic crash by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4978
• Fixed multiple issues with query parameter fuzzing by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4925
• Fixed issue with {{interactsh-url}} variable not working with nested variables by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4941
• Fixed issue with -ms option for templates using flow by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4978
• Fixed issue with -ms option generating blank target & template by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4969
• Fixed issue with sarif version by @tibbon in https://github.com/projectdiscovery/nuclei/pull/4976
• Fixed issue -no-color output by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4954
• Updated outdated JSONSchema library by @kchason in https://github.com/projectdiscovery/nuclei/pull/4943

New Contributors

• @llussy made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4958
• @tibbon made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4976

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.2.2...v3.2.3

What's Changed

• Fixed panic: assignment to entry in nil map and create default map by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4896

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.2.1...v3.2.2

What's Changed

• Added memguardian + various optimizations by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/4833
• Fixed overriding the predefined ratelimiter by WithGlobalRateLimit (sdk) by @kiokuless in https://github.com/projectdiscovery/nuclei/pull/4884
• Fixed issue with javascript protocol by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4893
• Updated templates loader/parser caches (refactor) by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/4867

New Contributors

• @debasishbsws made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4885
• @kiokuless made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4884
• @alizademhdi made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4892

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.2.0...v3.2.1

What's Changed

🎉 New Features

• Added fuzzing support in http protocol by @Ice3man543, @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4477
• Added authenticated scaning support by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4477
• Added -fuzz option for loading fuzzing templates @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4477
• Added Gitea reporting by @leonjza in https://github.com/projectdiscovery/nuclei/pull/4522
• Added transparent memoization via func annotation by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/4742
• Added issue tracker JSONL output + CLI summary by @Ice3man543 in https://github.com/projectdiscovery/nuclei/pull/4855
• Added self-contained request at http request level by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4812
• Added -payload-concurrency option by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4868
• Added disable-unsigned-templates option by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4820
• Added ldap protocol enhancements by @5amu in https://github.com/projectdiscovery/nuclei/pull/4667

🐞 Bug Fixes

• Fixed issue to purge cache on global callback set by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/4840
• Fixed network layer should not have forceful read by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/4737
• Fixed workflow to publish docs by @RamanaReddy0M in https://github.com/projectdiscovery/nuclei/pull/4743
• Fixed stop-at-first-match issue in http protocol by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4752
• Fixed header nil check by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4766
• Fixed issue to use maxsize in template by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4814
• Fixed issue to validate code template in workflows by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4822
• Fixed issue with temp file cleanup by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4835
• Fixed issue with nuclei loading ignored templates by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4849
• Fixed multiple bugs by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4868

Other Changes

• Added more granular, issue tracker level filtering by @leonjza in https://github.com/projectdiscovery/nuclei/pull/4780
• Added callback support to StandardWriter by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4839
• switched dependency for kerberos js module (ropnop/gorkb5 -> jcmturner/gokrb5) by @5amu in https://github.com/projectdiscovery/nuclei/pull/4647
• use system resolver first with system-resolvers by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/4740
• javascript bindings + docs generation enhancements by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4487

Issues closed in release - https://github.com/projectdiscovery/nuclei/milestone/43?closed=1

New Contributors

• @leonjza made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4522
• @AlexS778 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4785
• @fail-open made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4819

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.1.10...v3.2.0

What's Changed

• Fixed concurrent map writes in tmplexec package by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4718
• Added more NetworkConfig options to the SDK by @denysvitali-niantic in https://github.com/projectdiscovery/nuclei/pull/4719

New Contributors

• @denysvitali-niantic made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4719

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.1.9...v3.1.10

What's Changed

• Added hybrid tech detection (wappalyzer + tech templates) with automatic scan (-as) by @xxcdd @boy-hack in https://github.com/projectdiscovery/nuclei/pull/4656
• Added projectdiscovery/useragent by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4708
• Added passive option support in SDK by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4684
• Fixed issue with long running scans at the end of scan by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4715
• Fixed issue in javascript protocol with connection pooling by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4709

New Contributors

• @xxcdd made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4656

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.1.8...v3.1.9

What's Changed

• Fixed multiple memory leaks and optimizations by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4680
• Fixed issue with not resolving hosts from /etc/hosts file by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4686
• Fixed issue of array iteration in flow by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4688
• Fixed panic in smb javascript template by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4700
• Fixed an issue with case sensitive dns interaction with interactsh by @monitor403 in https://github.com/projectdiscovery/nuclei/pull/4697
• Fixed issue with reporting with optional support of -or option by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4612
• Fixed issue with mysql module in JavaScript by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4702

New Contributors

• @monitor403 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4697

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.1.7...v3.1.8

What's Changed

• Added support to pdpc result upload to existing scan using -scan-id option by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4662

  $ nuclei -u example.com -cloud-upload -scan-id XXXXXX

• Fixed issue with pdcp result upload with large output file by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4662
• Fixed issue with pdcp result upload when using with env variable by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4675

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.1.6...v3.1.7

What's Changed

• Added GetServiceTicket method to the kerberos module by @5amu in https://github.com/projectdiscovery/nuclei/pull/4422
• Added GetKerberoastableUsers method in ldap module by @5amu in https://github.com/projectdiscovery/nuclei/pull/4420
• Added support to dump resume files when a runner hangs by @wk8 in https://github.com/projectdiscovery/nuclei/pull/4440
• Fixed multiple memory leaks + optimizations by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4630
• Fixed timeout issue + added custom timeout support in js protocol by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4643
• Fixed variables merge order in code templates by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4623
• Fixed issue with dynamic extractors in flow by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4625
• Fixed panic in interactsh process interaction ( nil check on compiled operators) by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4511
• Fixed panic error + support offlinehttp in flow templates by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4653

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.1.5...v3.1.6

What's Changed

Other Changes

• Fixed a bug introduced in previous version by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4608

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.1.4...v3.1.5

What's Changed

🎉 New Features

• Added self-contained input support to fuzzing templates by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4531
• Added support to include additional custom tags with -as option by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4543
• Added internal matchers (to hide match results in flow) using internal: true by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4582
• Added exclude list support to layer 4 via fastdialer by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/4575

🐞 Bug Fixes

• Fixed issue with dynamic extracted variable to make it reusable by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4574
• Fixed early exit issue for non zero status code in code protocol by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4585
• Fixed missing results issue in flow based template by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4582

Other Changes

• deprecate(remove): file write in extractor using to attribute for security reasons by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4565
• Using network policy everywhere by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/4578

New Contributors

• @Anemys made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4566

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.1.3...v3.1.4

What's Changed

• Added email support to SMTP client in javascript protocol by @Marcuccio in https://github.com/projectdiscovery/nuclei/pull/4451
• Added Interface in Networkconfig (SDK) by @vince-isec in https://github.com/projectdiscovery/nuclei/pull/4472

Other Changes

• Fixed issue with blank value for query param by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4513
• Fixed issue with resume file creation by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4514
• Fixed an issue with auth check API by @ehsandeep in https://github.com/projectdiscovery/nuclei/pull/4527
• Updated README to point to centralized docs by @olearycrew in https://github.com/projectdiscovery/nuclei/pull/4521

New Contributors

• @vince-isec made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4472
• @Marcuccio made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4451

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.1.2...v3.1.3

What's Changed

Other Changes

• Fixed bug with network protocol: revert full buffer size read by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4497

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.1.1...v3.1.2

What's Changed

• Added support for arbitrary string input for TLS SNI annotation by @jimen0 in https://github.com/projectdiscovery/nuclei/pull/4462
• Fixed panic + refactor headless waitevent action by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4465
• Fixed wait time + added timeout for ssh connection by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4467
• Fixed issue with headless result upload by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4469

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.1.0...v3.1.1

What's Changed

🎉 New Features

• Added support to upload / view results into PDCP Dashboard by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4343
  

• Added support to exclude target from scan input list by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4214

  • exclude host, host:port
  • exclude ip, ip:port
  • exclude cidr
  • regex based exclusion

• Added support for multiple ports in network template by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4401

tcp:
  - host:
      - "{{Hostname}}"
    port: 22,2222

• Added port, scheme and url field in json(l) output by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4417
• Added support to execute commands via ssh client in javascript protocol by @5amu in https://github.com/projectdiscovery/nuclei/pull/4407

javascript:
  - args:
      Host: "{{Host}}"
      Port: "22"
    code: |
      var m = require("nuclei/ssh");
      var c = m.SSHClient();
      c.Connect(Host, Port, template.Username, template.Password)
      c.Run("echo lolz > /tmp/lolz");
      var response = c.Run("cat /tmp/lolz");
      c.Close()
      to_json(response);

• Added support to set dialer timeout by @wk8 in https://github.com/projectdiscovery/nuclei/pull/4441

 -dt, -dialer-timeout value            timeout for network requests.
 -dka, -dialer-keep-alive value        keep-alive duration for network requests.

• Added connection reset by peer to include error used for host exclusion by @XTeam-Wing in https://github.com/projectdiscovery/nuclei/pull/4265
• Added support to include failed matches for errored hosts with -ms option by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4373

Other Changes

• Fixed memory leaks in rawhttp by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4399
• Fixed issue with host field in json(l) output by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4417

Issues closed in this release - https://github.com/projectdiscovery/nuclei/milestone/44?closed=1

New Contributors

• @5amu made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4407
• @razin99 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4416
• @XTeam-Wing made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4265
• @wk8 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4441

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.0.4...v3.1.0

What's Changed

🎉 New Features

• Added base64 encoded template into json(l) result for custom templates with option to exclude by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4315

   -ot, -omit-template  omit encoded template in the JSON, JSONL output

• Added TLS Cipher, Version enumeration in SSL protocol by @mionskowski-form3 in https://github.com/projectdiscovery/nuclei/pull/4297

    tls_version_enum: true
    tls_cipher_enum: true
    tls_cipher_types: 
      - insecure 
      - weak

• Added base64 encoding helpers for javascript protocol by @Ice3man543 in https://github.com/projectdiscovery/nuclei/pull/4344

🐞 Bug Fixes

• Bugfix bin pack by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/4298

🔨 Maintenance

• Disabled code template as default with option to enable using -code flag by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4376
• Moved docs to centralized project https://github.com/projectdiscovery/docs by @olearycrew in https://github.com/projectdiscovery/nuclei/pull/4342
• Append exclude tags instead of replacing by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4353

Other Changes

• Enabled cookie-reuse as default with ability to disable optionally by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4292

    disable-cookie: true

• Added pprofiling with env by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4377

PPROF=1 ./nuclei -u https://scanme.sh

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.0.3...v3.0.4

What's Changed

• Added self-contained template support to headless protocol by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4322
• Added miscellaneous SDK enhancements by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4301
• Fixed issue with trailing dot in dns protocol by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4295
• Fixed connection issues in javascript, network protocol @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4313
• Fixed issue in flow to use javascript by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4313
• Updated cloned directory structure (project owner => repo) for GitHub by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/4293

New Contributors

• @atomiczsec made their first contribution in https://github.com/projectdiscovery/nuclei/pull/4296

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.0.2...v3.0.3

What's Changed

Other Changes

• Fixed relative path issue for template loading by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4284

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.0.1...v3.0.2

What's Changed

🐞 Bug Fixes

• Fixed issues with template preprocessor + multi request variables indexing by @tarunKoyalwar in https://github.com/projectdiscovery/nuclei/pull/4262

Note:

This release includes fixes for bugs introduced in v3.0; upgrade to the latest version if you are using v3.

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.0.0...v3.0.1