With the increasing digital assets and risks of potential security threats, organizations, security teams, individual researchers and stakeholders need to adapt automation for fast scanning capabilities. Nuclei is an open-source vulnerability scanner that automates vulnerability scanning and allows integration of the tool in existing automation, reconnaissance and CI/CD pipelines.
Nuclei utilizes YAML-based templates that serve as the core of the nuclei engine and detect vulnerabilities based on the patterns and instructions provided in the template file. In addition, one can create custom templates to automate their vulnerability scanning process, retesting one vulnerability pattern across various assets, performing regression testing, automated reporting and whatnot.
In this article, we are going to explore the power of nuclei custom templates and how it is going to be beneficial for the users.
What are Nuclei Templates?
As mentioned earlier, the Nuclei templates serve as the fundamental building blocks for the nuclei scanner, which forms the backbone of the actual scanning engine. These templates are stored and organized within a repository, serving as a centralized hub for various templates. In a nutshell, the nuclei templates contain different matches, rules and conditions to detect potential vulnerabilities. Below is an example of a basic structure of a nuclei template:
id: git-config
info:
name: Git Config File
author: Ice3man
severity: medium
description: Searches for the pattern /.git/config on passed URLs.
http:
- method: GET
path:
- "{{BaseURL}}/.git/config"
matchers:
- type: word
words:
- "[core]"ProjectDiscovery provides a repository of nuclei templates created by their team and contributed by the community. However, one can easily create custom templates following the template creation guide provided by ProjectDiscovery to automate their use cases. The manual for Nuclei Template can be found here: https://nuclei.projectdiscovery.io/templating-guide/
The Artistry of Custom Templates
While the pre-built repository of Nuclei templates offers a formidable arsenal of security checks, custom templates emerge as the pièce de résistance, empowering security practitioners to craft tailored security checks. So let’s discuss and dive deep to know why you should build and use custom nuclei templates to power up your testing.
Why Should You Be Using Custom Templates?
Targeted scanning
Nuclei custom templates are helpful for targeted scanning for a specific technology or vulnerability not already covered in the existing template library. For example, running all the nuclei templates is not very useful if a target organization uses an “nginx” server to power various applications.
Hence, one can create a simple nuclei workflow template to scan for issues specific to “nginx” only. Below is an example of creating a custom workflow template that will run only “nginx” specific checks once a server is detected as “nginx”.
id: nginx-workflow
info:
name: Nginx workflow
author: harsh
description: A simple workflow that runs all Nginx related nuclei templates on a given target.
workflows:
- template: http/technologies/nginx/nginx-detect.yaml
subtemplates:
- tags: nginx
This becomes handy to automate the scanning even for the internal teams who already know their target technologies. As a result, it saves a lot of time and prioritizes identifying vulnerabilities. Similarly, creating custom templates to perform checks for specific vulnerabilities is possible.
Custom reporting
Nuclei custom templates can be used to perform customized reporting per the environment's requirement. For example, a security researcher may want to automate the reporting to a bug bounty platform wherein an internal security team may look to report a vulnerability in a tracking system such as Jira. Hence, with the help of a custom reporting template, a user can prioritize their workflow as per the requirements.
For example, to create tickets on GitHub, create a config file with the following content and replace the appropriate values:
# GitHub contains configuration options for GitHub issue tracker
github:
username: "$user"
owner: "$user"
token: "$token"
project-name: "testing-project"
issue-label: "Nuclei"
Adapting to Evolving Threats
The primary use case of using custom templates is adapting to evolving threats. One can create a template to test for a specific CVE, 0-Day or a novel attack vector for testing it across various targets. For example, an organization wants to ensure they are secure against a particular CVE, and its vulnerability research team can create a working exploit for the specific CVE. However, scanning all the hosts could be a challenge. Hence, they can make a nuclei template for the exploit and run it across all the known hosts to check what vulnerable hosts are. This could help organizations stay ahead of the threat actors, detect issues in real-time quickly and remediate them on priority.
A typical example of a CVE (CVE-2023-3231) template looks like the following:
id: CVE-2023-32315
info:
name: Administration Console Authentication Bypass in Openfire Console
author: vsh00t
severity: high
description: |
<redacted>
remediation: |
<redacted>
reference:
- https://github.com/advisories/GHSA-gw42-f939-fhvm
- https://nvd.nist.gov/vuln/detail/CVE-2023-32315
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
cvss-score: 8.6
cve-id: CVE-2023-32315
cwe-id: CWE-22
metadata:
max-request: 1
verified: true
shodan-query: title:"openfire"
tags: cve,cve2023,auth-bypass,openfire,console
http:
- raw:
- |+
GET /setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp HTTP/1.1
Host: {{Hostname}}
Origin: {{BaseURL}}
unsafe: true
matchers-condition: and
matchers:
- type: word
part: body
words:
- "apache"
- "java"
- "openfire"
- "jivesoftware"
condition: and
- type: status
status:
- 200
Building PoCs for vulnerabilities
Similarly to creating custom templates for the CVEs and novel attack vectors, it is possible to use nuclei templates to develop Proof of Concept (PoC) demonstrations that the triage team could use (if you are doing bug bounty) or by the developers & internal security teams (if you are reporting issues internally) to ease the overall reproduction efforts and reduce involved steps.
For example, suppose you have found a race condition vulnerability in your target system. In that case, you can create a custom nuclei template to demonstrate the race condition vulnerability with minimal reproduction efforts required. A template for race condition issues could look something like the following:
id: race-condition-testing
info:
name: Race Condition testing
author: pdteam
severity: info
http:
- raw:
- |
POST /coupons HTTP/1.1
Host: {{Hostname}}
Pragma: no-cache
Cache-Control: no-cache, no-transform
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Cookie: user_session=42332423342987567896
promo_code=20OFF
race: true
race_count: 10
matchers:
- type: status
part: header
status:
- 200
Retesting vulnerabilities
When a vulnerability is found in one system, the same vulnerability could exist in other environments with the same code base or technology. Automating vulnerability detection using a custom nuclei template is feasible in such cases.
The custom template should include rules and conditions that target the specific vulnerability which was already identified. By defining appropriate HTTP requests, responses to look for, and patterns to match against, you can effectively identify the presence of the vulnerability.
For example, if cross-site scripting was identified in one WordPress system, a custom template like the following can be created to re-test it across different WordPress instances.
id: wp-socialfit-xss
info:
name: WordPress Plugin SocialFit - 'msg' Cross-Site Scripting
author: daffainfo
severity: medium
description: |
SocialFit plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
reference: |
- https://www.exploit-db.com/exploits/37481
tags: wordpress,xss,wp-plugin
requests:
- method: GET
path:
- '{{BaseURL}}/wp-content/plugins/socialfit/popup.php?service=googleplus&msg=%3Cscript%3Ealert%281%29%3C/script%3E'
matchers-condition: and
matchers:
- type: word
part: body
words:
- '<script>alert(1)</script>'
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200
Regression testing
The most important task one can perform is regression testing with the help of custom templates. The diagram below by ProjectDiscovery explains how nuclei custom templates can be used to perform regression testing.
For example, when a bug bounty hunter or a security researcher submits a vulnerability with a nuclei template or the internal team can create a custom template using the vulnerability report, the organization can add it to their regression testing repository.
Whenever a new build occurs, the security assessment includes running the regression test for identified vulnerabilities using the custom template. If the vulnerability is reproducible & detected, the developers can make the required changes. However, if the vulnerability is no longer seen, the code can be ready to ship in production.
Summary
We have learned how custom templates can be super helpful in multiple day-to-day cases. By leveraging the power of custom Nuclei templates, organizations and individuals can effectively enhance their security testing capabilities, optimize their workflows, and address-specific security needs. These templates provide a flexible and adaptable framework for proactive vulnerability detection and mitigation, ultimately bolstering the organization's security posture. If you are interested in learning to build custom templates yourself, you can follow this detailed guide: https://nuclei.projectdiscovery.io/templating-guide/
Want to learn more about the powerful things cooking in ProjectDiscovery’s kitchen? Make sure to subscribe to the newsletter.
Author: Harsh Bothra - @harshbothra_
