HD Moore
5b89811b90
Support concurrent Nuclei engines in the same process ( #6322 )
...
* support for concurrent nuclei engines
* clarify LfaAllowed race
* remove unused mutex
* update LfaAllowed logic to prevent races until it can be reworked for per-execution ID
* Update pkg/templates/parser.go
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* debug tests
* debug gh action
* fixig gh template test
* using atomic
* using synclockmap
* restore tests concurrency
* lint
* wiring executionId in js fs
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
2025-07-19 00:10:58 +05:30
HD Moore
f26996cb89
Remove singletons from Nuclei engine (continuation of #6210 ) ( #6296 )
...
* introducing execution id
* wip
* .
* adding separate execution context id
* lint
* vet
* fixing pg dialers
* test ignore
* fixing loader FD limit
* test
* fd fix
* wip: remove CloseProcesses() from dev merge
* wip: fix merge issue
* protocolstate: stop memguarding on last dialer delete
* avoid data race in dialers.RawHTTPClient
* use shared logger and avoid race conditions
* use shared logger and avoid race conditions
* go mod
* patch executionId into compiled template cache
* clean up comment in Parse
* go mod update
* bump echarts
* address merge issues
* fix use of gologger
* switch cmd/nuclei to options.Logger
* address merge issues with go.mod
* go vet: address copy of lock with new Copy function
* fixing tests
* disable speed control
* fix nil ExecuterOptions
* removing deprecated code
* fixing result print
* default logger
* cli default logger
* filter warning from results
* fix performance test
* hardcoding path
* disable upload
* refactor(runner): uses `Warning` instead of `Print` for `pdcpUploadErrMsg`
Signed-off-by: Dwi Siswanto <git@dw1.io>
* Revert "disable upload"
This reverts commit 114fbe6663361bf41cf8b2645fd2d57083d53682.
* Revert "hardcoding path"
This reverts commit cf12ca800e0a0e974bd9fd4826a24e51547f7c00.
---------
Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
Co-authored-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Dwi Siswanto <25837540+dwisiswant0@users.noreply.github.com>
2025-07-10 01:17:26 +05:30
circleous
b03c30418b
fix: fallback set SNI to host if not specified when using socks proxy ( #6218 )
2025-05-15 16:46:49 +05:30
Ice3man
5f0b7eb19b
feat: added initial live DAST server implementation ( #5772 )
...
* feat: added initial live DAST server implementation
* feat: more logging + misc additions
* feat: auth file support enhancements for more complex scenarios + misc
* feat: added io.Reader support to input providers for http
* feat: added stats db to fuzzing + use sdk for dast server + misc
* feat: more additions and enhancements
* misc changes to live server
* misc
* use utils pprof server
* feat: added simpler stats tracking system
* feat: fixed analyzer timeout issue + missing case fix
* misc changes fix
* feat: changed the logics a bit + misc changes and additions
* feat: re-added slope checks + misc
* feat: added baseline measurements for time based checks
* chore(server): fix typos
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix(templates): potential DOM XSS
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix(authx): potential NIL deref
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* feat: misc review changes
* removed debug logging
* feat: remove existing cookies only
* feat: lint fixes
* misc
* misc text update
* request endpoint update
* feat: added tracking for status code, waf-detection & grouped errors (#6028 )
* feat: added tracking for status code, waf-detection & grouped errors
* lint error fixes
* feat: review changes + moving to package + misc
---------
Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
* fix var dump (#5921 )
* fix var dump
* fix dump test
* Added filename length restriction for debug mode (-srd flag) (#5931 )
Co-authored-by: Andrey Matveenko <an.matveenko@vkteam.ru>
* more updates
* Update pkg/output/stats/waf/waf.go
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---------
Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
Co-authored-by: Dwi Siswanto <25837540+dwisiswant0@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Dogan Can Bakir <65292895+dogancanbakir@users.noreply.github.com>
Co-authored-by: 9flowers <51699499+Lercas@users.noreply.github.com>
Co-authored-by: Andrey Matveenko <an.matveenko@vkteam.ru>
Co-authored-by: Sandeep Singh <sandeep@projectdiscovery.io>
2025-02-13 18:46:28 +05:30
Dwi Siswanto
f21a82aac3
fix(httpclientpool): rebuild malformed Location URL ( #5902 )
...
Signed-off-by: Dwi Siswanto <git@dw1.io>
Co-authored-by: Doğan Can Bakır <dogancanbakir@protonmail.com>
2024-12-19 20:31:41 +05:30
Shubham Rasal
be1f634eae
Add Alive Proxy into Options ( #5903 )
...
* Move proxy variable from global to options
- Provides ability to pass diff proxy in single nuclei instance using sdk
* add type check (resolve comments)
2024-12-13 04:23:27 +05:30
Ice3man
b046f7686f
feat: Added time based delay analyzer to fuzzing implementation ( #5781 )
...
* feat: added fuzzing output enhancements
* changes as requested
* misc
* feat: added dfp flag to display fuzz points + misc additions
* feat: added support for fuzzing nested path segments
* feat: added parts to fuzzing requests
* feat: added tracking for parameter occurence frequency in fuzzing
* added cli flag for fuzz frequency
* fixed broken tests
* fixed path based sqli integration test
* feat: added configurable fuzzing aggression level for payloads
* fixed failing test
* feat: added analyzers implementation for fuzzing
* feat: misc changes to analyzer
* feat: misc additions of units + tests fix
* misc changes to implementation
2024-11-19 11:51:32 +05:30
mzack9999
5e102b782b
fixing race + nil crash
2024-08-21 16:09:47 +02:00
Doğan Can Bakır
46782ff90c
use sync.Once
2024-08-21 11:26:17 +03:00
Doğan Can Bakır
3064788d35
fix race condition
2024-08-19 23:02:27 +03:00
Mzack9999
bc229a46ca
Merge pull request #5331 from projectdiscovery/use_containsall
...
use `stringsutil.ContainsAll`
2024-07-15 13:21:03 +02:00
Dogan Can Bakir
f080d614c3
introduce timeouts config in types.Options ( #5228 )
...
* introduce timeout variants
* update instances and add codeexectimeout
* fix test
* default to 10s
* minor
* make timeouts pluggable and rename
* remove residual code
---------
Co-authored-by: Tarun Koyalwar <tarun@projectdiscovery.io>
2024-07-15 15:57:15 +05:30
Doğan Can Bakır
c7006a9168
use stringsutil.ContainsAll
2024-06-25 12:26:18 +03:00
Mzack9999
52975373ff
Merge branch 'dev' into feat-4808-planner
2024-06-13 17:19:43 +02:00
Tarun Koyalwar
8720e4f863
fix panic: ref #5217 ( #5230 )
2024-06-02 17:11:56 +05:30
mzack
46e2a54bfe
Merge branch 'dev' into feat-4808-planner
2024-05-25 02:45:54 +02:00
Tarun Koyalwar
23bd0336fb
multiple bug fixes + performance improvements ( #5148 )
...
* prototype errkit
* complete errkit implementation
* add cause to all timeouts
* fix request timeout annotation @timeout
* increase responseHeaderTimeout to 8 for stability
* rawhttp error related improvements
* feat: add port status caching
* add port status caching to http
* migrate to new utils/errkit
* remote dialinterface + error cause
* debug dir support using .gitignore debug-*
* make nuclei easy to debug
* debug dir update .gitignore
* temp change (to revert)
* Revert "temp change (to revert)"
This reverts commit d3131f777713b9f80e2275142e80f36340a76d36.
* use available context instead of new one
* bump fastdialer
* fix hosterrorscache + misc improvements
* add 'address' field in error log
* fix js vague errors + pgwrap driver
* fix max host error + misc updates
* update tests as per changes
* fix request annotation context
* remove closed dialer reference
* fix sdk panic issue
* bump retryablehttp-go,utils,fastdialer
---------
Co-authored-by: Sandeep Singh <sandeep@projectdiscovery.io>
2024-05-25 00:29:04 +05:30
Mzack9999
47ca8fe842
fix non gc-able dialer
...
closes #5165
2024-05-15 21:25:40 +02:00
Ice3man
0b82e8b7aa
feat: added support for context cancellation to engine ( #5096 )
...
* feat: added support for context cancellation to engine
* misc
* feat: added contexts everywhere
* misc
* misc
* use granular http timeouts and increase http timeout to 30s using multiplier
* track response header timeout in mhe
* update responseHeaderTimeout to 5sec
* skip failing windows test
---------
Co-authored-by: Tarun Koyalwar <tarun@projectdiscovery.io>
2024-04-25 15:37:56 +05:30
Dogan Can Bakir
a9efb75d59
introduce disable-cookie ( #4292 )
...
* introduce disable-cookie
* remove debug statement
* fix headless template
* increase `-interactions-poll-duration` value to 5
* docs update
---------
Co-authored-by: Tarun Koyalwar <tarun@projectdiscovery.io>
Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-11-18 13:02:10 +05:30
Tarun Koyalwar
dc44105baf
nuclei v3 : misc updates ( #4247 )
...
* use parsed options while signing
* update project layout to v3
* fix .gitignore
* remove example template
* misc updates
* bump tlsx version
* hide template sig warning with env
* js: retain value while using log
* fix nil pointer derefernce
* misc doc update
---------
Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-10-17 17:44:13 +05:30
