mirror of
https://github.com/projectdiscovery/nuclei.git
synced 2025-12-18 15:15:28 +00:00
b9472cf7e1
* Added fuzzing support for query params + var dump feature * Added query-fuzz integration test * Fixed payloads + added keys-regex fuzz parameter * Fixed interactsh not working + misc * Fixed evaluation + added global variables/dsl support to payloads * Misc fixes related to variables evaluations * Added http variables support to fuzz * misc * Misc * Added testing playground + misc renaming * Added support for path and raw request to fuzzing * Fixed fuzz integration test * Fixed variable unresolved issue * Add multiple parameter support with same name * Added parameter value as 'value' dsl variable for parts Co-authored-by: Sandeep Singh <sandeep@projectdiscovery.io>
75 lines
2.3 KiB
Go
75 lines
2.3 KiB
Go
package http
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/projectdiscovery/nuclei/v2/pkg/catalog/disk"
|
|
"github.com/projectdiscovery/nuclei/v2/pkg/protocols/common/generators"
|
|
)
|
|
|
|
func TestRequestGeneratorPaths(t *testing.T) {
|
|
req := &Request{
|
|
Path: []string{"{{BaseURL}}/test", "{{BaseURL}}/test.php"},
|
|
}
|
|
generator := req.newGenerator(false)
|
|
var payloads []string
|
|
for {
|
|
raw, _, ok := generator.nextValue()
|
|
if !ok {
|
|
break
|
|
}
|
|
payloads = append(payloads, raw)
|
|
}
|
|
require.Equal(t, req.Path, payloads, "Could not get correct paths")
|
|
}
|
|
|
|
func TestRequestGeneratorClusterBombSingle(t *testing.T) {
|
|
var err error
|
|
|
|
req := &Request{
|
|
Payloads: map[string]interface{}{"username": []string{"admin", "tomcat", "manager"}, "password": []string{"password", "test", "secret"}},
|
|
AttackType: generators.AttackTypeHolder{Value: generators.ClusterBombAttack},
|
|
Raw: []string{`GET /{{username}}:{{password}} HTTP/1.1`},
|
|
}
|
|
catalogInstance := disk.NewCatalog("")
|
|
req.generator, err = generators.New(req.Payloads, req.AttackType.Value, "", catalogInstance, "")
|
|
require.Nil(t, err, "could not create generator")
|
|
|
|
generator := req.newGenerator(false)
|
|
var payloads []map[string]interface{}
|
|
for {
|
|
_, data, ok := generator.nextValue()
|
|
if !ok {
|
|
break
|
|
}
|
|
payloads = append(payloads, data)
|
|
}
|
|
require.Equal(t, 9, len(payloads), "Could not get correct number of payloads")
|
|
}
|
|
|
|
func TestRequestGeneratorClusterBombMultipleRaw(t *testing.T) {
|
|
var err error
|
|
|
|
req := &Request{
|
|
Payloads: map[string]interface{}{"username": []string{"admin", "tomcat", "manager"}, "password": []string{"password", "test", "secret"}},
|
|
AttackType: generators.AttackTypeHolder{Value: generators.ClusterBombAttack},
|
|
Raw: []string{`GET /{{username}}:{{password}} HTTP/1.1`, `GET /{{username}}@{{password}} HTTP/1.1`},
|
|
}
|
|
catalogInstance := disk.NewCatalog("")
|
|
req.generator, err = generators.New(req.Payloads, req.AttackType.Value, "", catalogInstance, "")
|
|
require.Nil(t, err, "could not create generator")
|
|
|
|
generator := req.newGenerator(false)
|
|
var payloads []map[string]interface{}
|
|
for {
|
|
_, data, ok := generator.nextValue()
|
|
if !ok {
|
|
break
|
|
}
|
|
payloads = append(payloads, data)
|
|
}
|
|
require.Equal(t, 18, len(payloads), "Could not get correct number of payloads")
|
|
}
|