Exploit

Automating Bug Bounties with Nuclei: Harnessing the power of custom templates

Explore bug bounty automation with Nuclei templates, crafting custom scans, fuzzing, and CVE detection for effective security testing.

by Bhavarth Karmarkar

March 01, 2024

5 min read

Automating Bug Bounties with Nuclei: Harnessing the Power of Custom Templates

Hello, amazing Hackers! I am Bhavarth Karmarkar, Security Engineer Intern at BugBase, and welcome to this comprehensive guide on "Automating Bug Bounties with Nuclei." In this post, we will delve into the intricacies of Nuclei, an open-source vulnerability scanner, and explore the art of crafting custom templates to supercharge your bug hunting endeavors.

Table of Contents#

[Why Use Custom Templates?]
[The Basics of Writing Custom Templates]
[Fuzzing Techniques for Vulnerability Detection]
[Debugging and Validation]

Why Use Custom Templates?#

In the realm of bug bounties, relying solely on default templates can make you just another script kiddie. Custom templates not only set you apart but also cater to the uniqueness of your target vulnerabilities. Here's why:

1. Targeted Scanning#

When dealing with specific technologies or vulnerabilities not covered in default templates, custom templates shine. For instance, if a target organization predominantly uses an "nginx" server, crafting a custom workflow template for "nginx" specific checks can save time and lead to more focused results.

yaml

id: nginx-workflow
info:
  name: Nginx workflow
  author: <author>
  description: A workflow for running Nginx-related nuclei templates on a given target.
workflows:
  - template: http/technologies/nginx/nginx-detect.yaml
    subtemplates:
      - tags: nginx

2. Custom Reporting#

Tailor your reporting based on your environment's requirements. Whether automating bug bounty platform submissions or integrating with internal tracking systems like Jira, custom reporting templates empower users to prioritize their workflow effectively.

yaml

# GitHub configuration for GitHub issue tracker
github: 
  username: "$user"
  owner: "$user"
  token: "$token"
  project-name: "testing-project"
  issue-label: "Nuclei"

3. Adapting to Evolving Threats#

Stay ahead of the game by creating templates to test for specific CVEs, 0-Days, or novel attack vectors across various targets. For instance, a template for CVE-2023-32315 might look like this:

yaml

id: CVE-2023-32315
info:
  name: Administration Console Authentication Bypass in Openfire Console
  author: <author>
  severity: high
  description: |
    <redacted>
  remediation: |
    <redacted>
  reference:
    - https://github.com/advisories/GHSA-gw42-f939-fhvm
    - https://nvd.nist.gov/vuln/detail/CVE-2023-32315
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
    cvss-score: 8.6
    cve-id: CVE-2023-32315
    cwe-id: CWE-22
  metadata:
    max-request: 1
    verified: true
    shodan-query: title:"openfire"
  tags: cve,cve2023,auth-bypass,openfire,console
http:
  - raw:
      - |+
        GET /setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}
    unsafe: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "apache"
          - "java"
          - "openfire"
          - "jivesoftware"
        condition: and
      - type: status
        status:
          - 200

4. Building PoCs for Vulnerabilities#

Craft templates not just for detecting vulnerabilities but also for developing Proof of Concept (PoC) demonstrations. Simplify the reproduction efforts for triage teams, developers, and internal security teams.

yaml

id: race-condition-testing
info:
  name: Race Condition testing
  author: <author>
  severity: info
http:
  - raw:
      - |
        POST /coupons HTTP/1.1
        Host: {{Hostname}}
        Pragma: no-cache
        Cache-Control: no-cache, no-transform
        User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
        Cookie: user_session=42332423342987567896
        promo_code=20OFF        
    race: true
    race_count: 10
    matchers:
      - type: status
        part: header
        status:
          - 200

5. Retesting Vulnerabilities#

Automate the detection of known vulnerabilities across different environments with custom templates. Ensure that identified vulnerabilities are consistently retested and addressed.

yaml

id: wp-socialfit-xss
info:
  name: WordPress Plugin SocialFit - 'msg' Cross-Site Scripting
  author: <author>
  severity: medium
  description: |
    SocialFit plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
  reference: |
    - https://www.exploit-db.com/exploits/37481
  tags: wordpress,xss,wp-plugin
requests:
  - method: GET
    path:
      - '{{BaseURL}}/wp-content/plugins/socialfit/popup.php?service=googleplus&msg=%3Cscript%3Ealert%281%29%3C/script%3E'
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(1)</script>'
      - type: word
        part: header
        words:
          - "text/html"
      - type: status
        status:
          - 200

6. Regression Testing#

Perform crucial regression testing with custom templates. Ensure that identified vulnerabilities continue to be detected in subsequent builds, promoting a robust security assessment.
ProjectDiscovery's diagram illustrating nuclei custom templates for regression testing

The Basics of Writing Custom Templates#

Now, let's shift our focus to the basics of crafting custom templates. A template should contain essential information such as the template id, template info, data to send to the remote host, and instructions on how to analyze the response.

yaml

id: htpasswd
info:
  name: Detect exposed .htpasswd files
  author: <author>
  severity: info
  tags: config,exposure
requests:
  - method: GET
    path:
      - "{{BaseURL}}/.htpasswd"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - ":{SHA}"
          - ":$apr1$"
          - ":$2y$"
        condition: or
      - type: status
        status:
          - 200

Breaking it down:

id: Unique identifier for the template.
info: Metadata about the template, including name, author, severity, and tags.
requests: Defines the HTTP request(s) to be sent to the remote host.
matchers: Specifies how to analyze the response for potential vulnerabilities.

Fuzzing Techniques for Vulnerability Detection#

Fuzzing, a technique involving sending unexpected or malformed data to a software application, plays a vital role in security testing. Nuclei templates automate fuzzing, allowing you to define the base request, injection points, and response analysis.
Let's consider a simple template for fuzzing web services to discover undocumented HTTP request headers:

yaml

id: my-test-nuclei-template
info:
  name: X Debug header fuzzing
  author: <author>
  severity: info
  description: Discover x-*-debug request headers
requests:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-{{fuzz}}-debug: 1
    redirects: true
    attack: batteringram
    payloads:
      fuzz: /var/tmp/fuzz.txt

Breaking it down:

raw: Allows full control over the HTTP request.
payloads: Specifies the fuzzing injection point and payload list.
attack: Defines the fuzzing mode (e.g., batteringram, pitchfork, clusterbomb).
matchers: Specifies how to analyze the response.

Debugging and Validation#

Debugging is an integral part of template development. Nuclei offers several debugging features to troubleshoot template behavior:

Validate (-validate): Ensures the template syntax is correct.
Verbose Output (-verbose | -v): Prints verbose output generated by templates.
Debug (-debug): Prints all requests and responses made by the template.
Proxy (-p): Allows inspection of requests and responses using an external tool.
For example:

bash

nuclei -l targets.txt -t my-template.yaml -validate
nuclei -l targets.txt -t my-template.yaml -v
nuclei -l targets.txt -t my-template.yaml -debug
nuclei -l targets.txt -t my-template.yaml -p http://127.0.0.1:8080

There you have it – a comprehensive guide on automating bug bounties with Nuclei through the creation and utilization of custom templates. Experiment, adapt, and elevate your bug hunting game with the power of tailored vulnerability scanning. Happy hacking!
Stay tuned for more insightful content, and feel free to connect with me on LinkedIn for discussions and collaborations.

Summarize with AI: What Pentest Copilot Does

Summarize with AI: What Pentest Copilot Does

Automating Bug Bounties with Nuclei: Harnessing the power of custom templates

Automating Bug Bounties with Nuclei: Harnessing the Power of Custom Templates

Table of Contents#

Why Use Custom Templates?#

1. Targeted Scanning#

2. Custom Reporting#

3. Adapting to Evolving Threats#

4. Building PoCs for Vulnerabilities#

5. Retesting Vulnerabilities#

6. Regression Testing#

The Basics of Writing Custom Templates#

Fuzzing Techniques for Vulnerability Detection#

Debugging and Validation#

These debugging options facilitate effective troubleshooting and refinement of your custom templates.#