Nuclei

Introduction Many cloud service providers offer a "metadata" service on their virtual machines. These services offer sensitive details about the instance and cloud operating environment. Metadata services offer REST APIs to programmatically retrieve this data. Amazon’s AWS service defined the IMDSv1 “standard” on their EC2 instances, and

We search for secret leaks in a variety of places including GitHub, JS files, HTTP replies, source code, and other places. Once we've identified these keys, the next question is: what service does this key belong to, and is it valid? Answers to those questions determines the severity

We'd like to thank @c3l3si4n for disclosing the first security vulnerability that affects nuclei. This blog describes a brief overview of the security issue/impact and the measures we took to address it. Issue Summary The nuclei engine has a code execution vulnerability using components with known vulnerabilities

Nuclei YAML Syntax Documentation A common problem with YAML syntax is figuring out all the supported fields and their relevant documentation. With Nuclei, this has always been a barrier of entry for people new to the project. This Automatically Generated Documentation for Nuclei YAML Syntax is a step in this

The new nuclei v2.4.0 release includes a slew of bug fixes and feature enhancements that improve the overall uniformity, stability, and functionality of the tool. Uniform This version includes improvements to the template execution process, with the nuclei-templates repository now serving as the default entry point. This means

Within the v2.3.0 release, we've introduced File based scanning capabilities into the Nuclei engine. If you are already a Nuclei user, you will find it familiar because it follows the same principles as the HTTP based templates. We wanted to provide a similar approach to make

We released interactsh, a server that can emulate a DNS, HTTP, HTTPS and SMTP server, allowing users to test for Out of Band Security vulnerabilities. Nuclei v2.3.6 now supports using the interact.sh API to achieve OOB based vulnerability scanning with automatic Request correlation built in. It'

What Is a Race Condition Vulnerability? A race condition attack happens when a computing system that’s designed to handle tasks in a specific sequence is forced to perform two or more operations simultaneously. This technique takes advantage of a time gap between the moment a service is initiated and

A step-by-step introduction to writing effective network fingerprinting and exploitation templates in Nuclei the easy way. We recently introduced TCP Network protocol templating capabilities to nuclei. The most common question has been about how these network templates are created. In this post, we will take a look at how one