e832ef3b46
- New discovery engine (engine/discovery.sh): crawls target for real URLs, forms, parameters, and API endpoints before attacking - New nuclei vector (21): runs nuclei templates for real CVE detection (critical/high/medium severity) - Rebuilt SQLi vector: tests discovered forms and URL params with error-based and time-based blind payloads, sqlmap injection - Rebuilt XSS vector: multi-context payloads against discovered forms/params, confirms payload reflection - Rebuilt LFI vector: tests all discovered and common file parameters with traversal payloads, confirms by reading /etc/passwd - Updated main analyzer with 5-step pipeline: connectivity → discovery → recon → Ollama brain → exploitation
107 lines
3.3 KiB
Bash
107 lines
3.3 KiB
Bash
#!/usr/bin/env bash
|
|
# Vector 21: Nuclei — Real CVE Detection
|
|
# Desc: Runs nuclei templates against discovered endpoints to find real CVEs
|
|
# Detect: Any target with reachable endpoints
|
|
# Severity: CRITICAL
|
|
# Tools: nuclei
|
|
|
|
vector_nuclei() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local domain=$(get_domain "$target")
|
|
local findings=0
|
|
|
|
print_info "Running Nuclei — real CVE detection..."
|
|
|
|
if ! command -v nuclei &>/dev/null; then
|
|
print_skip "nuclei not installed. Skipping CVE scanning."
|
|
return 0
|
|
fi
|
|
|
|
# Check nuclei templates exist
|
|
if [ ! -d "$HOME/nuclei-templates" ] && [ ! -d "/root/nuclei-templates" ]; then
|
|
print_warn "Nuclei templates not found. Updating..."
|
|
nuclei -update-templates 2>/dev/null | tail -1
|
|
fi
|
|
|
|
# Nuclei output file
|
|
local nuclei_out="$REPORTS_DIR/.${domain}_nuclei.json"
|
|
|
|
print_sub "Scanning with nuclei (severity: critical, high, medium)..."
|
|
print_info "This may take 1-3 minutes..."
|
|
|
|
# Run nuclei with focused templates
|
|
nuclei -u "$target" \
|
|
-severity critical,high,medium \
|
|
-json \
|
|
-o "$nuclei_out" \
|
|
-rate-limit 50 \
|
|
-concurrency 10 \
|
|
-timeout 8 \
|
|
-retries 1 \
|
|
-silent 2>/dev/null &
|
|
|
|
local nuclei_pid=$!
|
|
|
|
# Show spinner while waiting
|
|
local waited=0
|
|
while kill -0 $nuclei_pid 2>/dev/null; do
|
|
sleep 2
|
|
waited=$((waited + 2))
|
|
if [ $waited -ge 120 ]; then
|
|
print_warn "Nuclei timeout (2min), killing..."
|
|
kill $nuclei_pid 2>/dev/null
|
|
break
|
|
fi
|
|
done
|
|
|
|
wait $nuclei_pid 2>/dev/null
|
|
|
|
# Parse results
|
|
if [ -f "$nuclei_out" ] && [ -s "$nuclei_out" ]; then
|
|
local vuln_count=$(wc -l < "$nuclei_out" | tr -d ' ')
|
|
|
|
if [ "$vuln_count" -gt 0 ]; then
|
|
print_find "Nuclei found $vuln_count vulnerabilities!"
|
|
|
|
while IFS= read -r line; do
|
|
[ -z "$line" ] && continue
|
|
|
|
local template=$(echo "$line" | jq -r '.templateID // "unknown"' 2>/dev/null)
|
|
local name=$(echo "$line" | jq -r '.info.name // "Unknown"' 2>/dev/null)
|
|
local severity=$(echo "$line" | jq -r '.info.severity // "unknown"' 2>/dev/null)
|
|
local matched=$(echo "$line" | jq -r '.matched // ""' 2>/dev/null)
|
|
local curl_cmd=$(echo "$line" | jq -r '.curl-command // ""' 2>/dev/null)
|
|
local extract=$(echo "$line" | jq -r '.extracted-results // [] | join(", ")' 2>/dev/null)
|
|
|
|
local sev_upper=$(echo "$severity" | tr '[:lower:]' '[:upper:]')
|
|
|
|
# Save finding
|
|
echo "SEVERITY: $sev_upper
|
|
VECTOR: Nuclei - $template
|
|
DETAIL: $name on $matched
|
|
EVIDENCE: $extract
|
|
EXPLOIT: $curl_cmd" > "$REPORTS_DIR/.finding_$(date +%s)_nuclei-${template}.txt"
|
|
|
|
findings=$((findings + 1))
|
|
|
|
# Print to screen
|
|
case "$severity" in
|
|
critical) echo -e " ${BRIGHT_RED}🔴 [CRITICAL]${NC} $name" ;;
|
|
high) echo -e " ${RED}🟠 [HIGH]${NC} $name" ;;
|
|
medium) echo -e " ${YELLOW}🟡 [MEDIUM]${NC} $name" ;;
|
|
*) echo -e " ${BLUE}🔵 [$severity]${NC} $name" ;;
|
|
esac
|
|
[ -n "$matched" ] && echo -e " ${DIM} $matched${NC}"
|
|
|
|
done < "$nuclei_out"
|
|
else
|
|
print_ok "Nuclei found no vulnerabilities"
|
|
fi
|
|
else
|
|
print_ok "Nuclei found no vulnerabilities"
|
|
fi
|
|
|
|
return $findings
|
|
}
|