Detect word match

[eugui]

Hi,

I have a simple template that uses words and I have a match, but I don't know which word was used to match.

id: test123

info:
  name: test123
  author: test
  severity: low
  description: test

requests:
  - method: GET
    path:
      - '{{BaseURL}}/'

    redirects: true
    max-redirects: 2
    stop-at-first-match: true
    matchers-condition: and
      - type: word
        part: body
        words:
          - "234.com"
          - "c423c4.com"
          - "423c423.com"
          - "c432443.com"
          - "22334.com"
          - "c432c.com"
        condition: or          

./nuclei -t test123.yaml -u https://test.com -v -svd -debug -ts -stats

output

[2024-04-19 13:00:52] [test123:status-1] [http] [low] https://test.com/
[2024-04-19 13:00:52] [test123:word-2] [http] [low] https://test.com/

[rxerium]

Hey @eugui you could use extractors to extract the finding from which you will be able to see what it matched on. Documentation for extractors can be found here. 😊

[eugui]

Hi @rxerium,

Thank you but I don't know how to use a "dynamic" extractor to detect the word that was "matched".

My "words" - more than 100 words

I would like something like:

[2024-04-19 13:00:52] [test123:word-2] [http] [low] https://test.com/ [c432443.com]

note: only c432443.com was detected

[rxerium]

Let me know if this works for you :)

id: test123

info:
  name: test123
  author: test
  severity: low
  description: test

requests:
  - method: GET
    path:
      - '{{BaseURL}}'

    redirects: true
    max-redirects: 2
    stop-at-first-match: true

    matchers:
      - type: word
        part: body
        words:
          - "234.com"
          - "c423c4.com"
          - "423c423.com"
          - "c432443.com"
          - "22334.com"
          - "c432c.com"
        condition: or   

    extractors:
      - type: regex
        part: body
        regex:
          - "(234.com|c423c4.com|423c423.com|c432443.com|22334.com|c432c.com)"

[eugui]

@rxerium

I wouldn't want to do that because my list has too many words (more than 450).

[rxerium]

Apologies I can't be of much help and might be one for the PD team to answer; they may have an efficient way of creating a template tailored for your use case.

[eugui]

thank you @rxerium

[dogancanbakir]

This discussion closed automatically due to inactivity. Feel free to reopen or start new if still relevant.