Commit Graph

680 Commits

Author SHA1 Message Date
Deamhan
488d5886ea fix(charts): fixed out of bounds read (#6607) 2025-11-14 17:16:39 +05:30
Doğan Can Bakır
cf5557e0fd bump version 2025-11-12 13:57:11 +09:00
Mzack9999
aecef0ab75 Merge branch 'dev' into feat-gozero-virtual 2025-11-08 06:01:01 +04:00
Mzack9999
0dde27f41d Merge pull request #6588 from projectdiscovery/6491_add_nuclei_template_dir_env_variable
add env variable for nuclei tempaltes dir
2025-11-08 05:52:44 +04:00
Doğan Can Bakır
90d51f733a add env variable for nuclei tempaltes dir 2025-11-05 18:15:57 +03:00
Dwi Siswanto
d7da0e0914 fix(http): resolve timeout config issues (#6562)
across multiple layers

Fixes timeout configuration conflicts where HTTP
requests would timeout prematurely despite
configured values in `@timeout` annotations or
`-timeout` flags.

RCA:
* `retryablehttp` pkg overriding with default
  30s timeout.
* Custom timeouts not propagating to
  `retryablehttp` layer.
* Multiple timeout layers not sync properly.

Changes:
* Propagate custom timeouts from `@timeout`
  annotations to `retryablehttp` layer.
* Adjust 5-minute maximum cap to prevent DoS via
  extremely large timeouts.
* Ensure `retryableHttpOptions.Timeout` respects
  `ResponseHeaderTimeout`.
* Add comprehensive tests for timeout capping
  behavior.

This allows templates to override global timeout
via `@timeout` annotations while preventing abuse
thru unreasonably large timeout values.

Fixes #6560.

Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-11-04 08:51:17 +07:00
Dwi Siswanto
7e33712d08 fix(templates): mem leaks in parser cache
Fixes duplicate template storage & removes
unnecessary raw bytes caching.

Mem usage reduced by ~30%.
> 423MB => 299MB heap alloc.

* Use `StoreWithoutRaw()` to avoid storing raw
  bytes.
* Remove duplicate storage in both caches.
* Remove ineffective raw bytes retrieval logic.

Benchmarks show 45% perf improvement with no
regressions.

Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-11-03 20:27:03 +07:00
Dwi Siswanto
770f20eeab feat(templates): add file metadata fields to parsedTemplate (#6534)
* feat(templates): add file metadata fields to `parsedTemplate`

to track template file information for cache
validation purposes.

closes #6515.

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore(templates): satisfy lints

Signed-off-by: Dwi Siswanto <git@dw1.io>

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-11-02 19:09:03 +07:00
Mzack9999
5b5d87f62a Merge pull request #6508 from chovanecadam/ssh-keyboard-interactive
SSH keyboard-interactive
2025-11-02 16:05:51 +04:00
Dwi Siswanto
7fc4752a95 chore(js): migrate github.com/go-pg/pg => github.com/go-pg/pg/v10
Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-11-02 01:12:11 +07:00
Dwi Siswanto
248bac75a0 feat(js): enhance SSH keyboard interactive auth
by:
* implement regex-based prompt matching for
  password variants.
* add support for filling username prompts in
  keyboard interactive challenges.
* improve debug logging with structured output.

this addresses issues with servers using
non-standard prompt formats and provides better
visibility into auth failures.

Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-11-02 00:38:37 +07:00
Adam Chovanec
6794b9cba0 fix: add logging 2025-11-02 00:38:37 +07:00
Adam Chovanec
8136d4f368 fix: provide answer only when asked for 2025-11-02 00:38:36 +07:00
Adam Chovanec
1a8124679e feat: best-effort keyboard-interactive support for SSH 2025-11-02 00:38:35 +07:00
Deamhan
f3181b9a2a fix(headless): fixed memory leak issue during page initialization (#6569)
* fix(headless): fixed memory leak issue during page initialization

* fix(headless): typo fix and added comment

* fix(headless): one more typo fix
2025-11-02 00:33:25 +07:00
Dwi Siswanto
dd8946d3f2 chore: satisfy lints
Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-10-30 09:41:01 +07:00
Mzack9999
e535e0126f adding tests 2025-10-28 14:19:12 +04:00
Mzack9999
9d59fd0188 adding xpath + json extractors 2025-10-28 14:19:06 +04:00
Mzack9999
3384606dea adding support for execution in docker 2025-10-25 00:31:03 +04:00
Dwi Siswanto
d2ae3521cc refactor(disk): templates catalog (#5914)
* refactor(disk): templates catalog

Signed-off-by: Dwi Siswanto <git@dw1.io>

* feat(disk): drying err

Signed-off-by: Dwi Siswanto <git@dw1.io>

* feat(disk): simplify `DiskCatalog.OpenFile` method

since `BackwardsCompatiblePaths` func is already
deprecated.

Signed-off-by: Dwi Siswanto <git@dw1.io>

* test: update functional test cases

Signed-off-by: Dwi Siswanto <git@dw1.io>

* feat: reuse error

Signed-off-by: Dwi Siswanto <git@dw1.io>

* fix(disk): handle glob errors consistently

Signed-off-by: Dwi Siswanto <git@dw1.io>

* fix(disk): use forward slashes for fs.FS path ops

to fix Windows compat.

The io/fs package requires forward slashes ("/")
as path separators regardless of the OS. Using
[filepath.Separator] or [os.PathSeparator] breaks
[fs.Open] and [fs.Glob] ops on Windows where the
separator is backslash ("\").

Signed-off-by: Dwi Siswanto <git@dw1.io>

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-10-24 07:31:35 +07:00
Ice3man
f3298323f3 fix: populate req_url_pattern before event creation (#6547) 2025-10-24 03:06:12 +05:30
Dogan Can Bakir
ae52ef04c9 Merge pull request #6545 from projectdiscovery/bugfix-6329-clientpool
clean up pools after 24hours inactivity
2025-10-22 22:41:20 +03:00
Mzack9999
b9ce0c2226 fixing syntax 2025-10-22 19:11:26 +04:00
Mzack9999
5557f4eae3 fixing lint 2025-10-21 16:57:26 +04:00
Mzack9999
f6efa9da6c clean up pools after 24hours inactivity 2025-10-21 16:41:26 +04:00
Mzack9999
5b7b83618c fixing failing integration tests 2025-10-21 14:29:15 +04:00
Matej Smycka
361f877730 Http probing optimizations high ports (#6538)
* feat: Assume HTTP(S) server on high port is HTTP

* feat: enhance http probing tests

* improving issue description

---------

Co-authored-by: Matej Smycka <smycka@ics.muni.cz>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
2025-10-18 17:35:37 +05:30
Dwi Siswanto
19554a793d perf(loader): reuse cached parsed templates (#6504)
* perf(loader): reuse cached parsed templates

in `(*Store).areWorkflowOrTemplatesValid`, which
is being called during template `-validate`-ion.

Signed-off-by: Dwi Siswanto <git@dw1.io>

* refactor(testutils): optionally assign template info

in `NewMockExecuterOptions`, which is not
required for specific case, like when we want to
`(*Store).ValidateTemplates`.

Signed-off-by: Dwi Siswanto <git@dw1.io>

* test(loader): adds `(*Store).ValidateTemplates` bench

Signed-off-by: Dwi Siswanto <git@dw1.io>

* refactor(templates): adds fast read parser

Signed-off-by: Dwi Siswanto <git@dw1.io>

* test(templates): adds `Parser*` benchs

Signed-off-by: Dwi Siswanto <git@dw1.io>

* chore(templates): satisfy lints

Signed-off-by: Dwi Siswanto <git@dw1.io>

* revert(templates): rm fast read parser

Signed-off-by: Dwi Siswanto <git@dw1.io>

---------

Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-10-14 21:17:15 +05:30
Dogan Can Bakir
e6c1a80498 Merge pull request #6528 from projectdiscovery/6523_make_verbose
log failed expr compilations
2025-10-14 18:40:01 +03:00
Dogan Can Bakir
dcdc7ebc32 Merge pull request #6521 from pstoeckle/dev
chore(typos): fix typos
2025-10-14 13:45:09 +03:00
chuu
0974d7fd04 fix(variable): global variable not same between two request in flow mode (#6395)
* fix(variable): global variable not same between two request in flow mode(#6337)

* update gitignore

---------

Co-authored-by: chuu <7704684+lizhi3n@user.noreply.gitee.com>
Co-authored-by: PDTeamX <8293321+ehsandeep@users.noreply.github.com>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
2025-10-14 15:27:53 +05:30
Doğan Can Bakır
cc1d646347 log failed expr compilations 2025-10-13 14:41:27 +03:00
Patrick Stoeckle
bfef42f9e3 chore(typos): fix typos 2025-10-10 17:32:54 +02:00
Mzack9999
4e2af6bf67 Merge pull request #6373 from mielverkerken/dev
Add option to control number of concurrent templates loaded on startup
2025-10-09 16:05:39 +02:00
Mzack9999
e0d3bb45ed small changes 2025-10-06 22:38:43 +02:00
Matej Smycka
67571b3cfe feat: http(s) probing optimization 2025-10-06 13:30:02 +02:00
Mzack9999
75016d1e96 Merge pull request #6500 from projectdiscovery/dwisiswant0/fix/issue-6499-6498
fix: suppress warn code flag not found & excludes known misc dir
2025-10-06 11:06:48 +02:00
Doğan Can Bakır
3597ab07f0 ai recommendations 2025-10-01 12:46:43 +03:00
Doğan Can Bakır
0f4f4b94e6 Merge branch 'dev' into mielverkerken-dev 2025-10-01 12:36:55 +03:00
Dwi Siswanto
c903da3a0c fix(config): normalize fpath in IsTemplate
* normalize file `fpath` in `IsTemplate` using
  filepath.FromSlash to ensure consistent matching
  across platforms.
* update `GetKnownMiscDirectories` docs to clarify
  that trailing slashes prevent false positives,
  since `IsTemplate` compares against normalized
  full paths.

Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-09-30 00:40:47 +07:00
Dwi Siswanto
b529125031 refactor(confif): update known misc dirs & improve IsTemplate func
Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-09-27 16:02:12 +07:00
Dwi Siswanto
ca11a2fad6 fix(disk): uses config.IsTemplate instead
fixes #6499

Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-09-27 15:21:38 +07:00
Dwi Siswanto
7d450507f7 feat(config): adds known misc directories
and excludes em in IsTemplate func.

Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-09-27 15:20:45 +07:00
Dwi Siswanto
95a72cfd50 fix(templates): suppress warn code flag not found
on validate.

fixes #6498

Signed-off-by: Dwi Siswanto <git@dw1.io>
2025-09-27 13:34:28 +07:00
Mzack9999
cb2d93174a fixing logic 2025-09-25 22:46:40 +02:00
Mzack9999
61bd0828dc Merge branch 'dev' into RDP-Enc-func 2025-09-25 22:07:17 +02:00
Dogan Can Bakir
d44f07f648 Merge pull request #6495 from projectdiscovery/fix_headless_loading
fix headless template loading logic when `-dast` option is enabled
2025-09-24 13:11:28 +03:00
Nakul Bharti
93be3b8291 fix: improve cleanup in parallel execution (#6490) 2025-09-24 01:12:43 +05:30
Doğan Can Bakır
202524283b fix headless template loading logic when -dast option is enabled 2025-09-23 16:43:08 +03:00
Nakul Bharti
8ea5061f5e jira: hotfix for Cloud to use /rest/api/3/search/jql (#6489)
* jira: hotfix for Cloud to use /rest/api/3/search/jql in FindExistingIssue; add live test verifying v3 endpoint

* jira: fix Cloud v3 search response handling (no total); set Self from base

* fix lint error

* tests(jira): apply De Morgan to satisfy staticcheck QF1001
2025-09-22 22:44:10 +05:30