Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion templates/protocols/code.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
sidebarTitle: "Code"
---

Nuclei enables the execution of external code on the host operating system. This feature allows security researchers, pentesters, and developers to extend the capabilities of Nuclei and perform complex actions beyond the scope of regular supported protocol-based testing.

Check warning on line 9 in templates/protocols/code.mdx

View check run for this annotation

Mintlify / Mintlify Validation (projectdiscovery) - vale-spellcheck

templates/protocols/code.mdx#L9

Did you really mean 'pentesters'?

By leveraging this capability, Nuclei can interact with the underlying operating system and execute custom scripts or commands, opening up a wide range of possibilities. It enables users to perform tasks such as system-level configurations, file operations, network interactions, and more. This level of control and flexibility empowers users to tailor their security testing workflows according to their specific requirements.

Expand All @@ -18,14 +18,29 @@
```
## Engine

To execute the code, a list of language interpreters, which are installed or available on the system environment, is specified. These interpreters can be and not limited to `bash` `sh` `py` `python3`, `go`, `ps`, among others, and they are searched sequentially until a suitable one is found. The identifiers for these interpreters should correspond to their respective names or identifiers recognized by the system environment.
To execute the code, a list of language interpreters, which are installed or available on the system environment, is specified. These interpreters can be and not limited to `bash` `sh` `py` `python3`, `go`, `ps`, `pwsh`, among others, and they are searched sequentially until a suitable one is found. The identifiers for these interpreters should correspond to their respective names or identifiers recognized by the system environment.

```yaml
- engine:
- py
- python3
```

## Common Interpreters

The following are some of the most commonly used interpreters with the Code protocol:

### Python

Python is widely available on most systems and can be used with engines such as `py`, `python`, or `python3`. Python is typically pre-installed on macOS and many Linux distributions.

### PowerShell

PowerShell can be used with engines such as `pwsh`, `powershell`, or `powershell.exe`. PowerShell may need to be installed separately depending on your operating system:

- **macOS**: [Install PowerShell on macOS](https://learn.microsoft.com/en-us/powershell/scripting/install/install-powershell-on-macos)
- **Linux**: [Install PowerShell on Linux](https://learn.microsoft.com/en-us/powershell/scripting/install/install-powershell-on-linux)

The code to be executed can be provided either as an external file or as a code snippet directly within the template.

For an external file:
Expand All @@ -41,11 +56,11 @@
print("hello from " + sys.stdin.read())
```

The target is passed to the template via stdin, and the output of the executed code is available for further processing in matchers and extractors. In the case of the Code protocol, the response part represents all data printed to stdout during the execution of the code.

Check warning on line 59 in templates/protocols/code.mdx

View check run for this annotation

Mintlify / Mintlify Validation (projectdiscovery) - vale-spellcheck

templates/protocols/code.mdx#L59

Did you really mean 'matchers'?

## Parts

Valid `part` values supported by **Code** protocol for Matchers / Extractor are -

Check warning on line 63 in templates/protocols/code.mdx

View check run for this annotation

Mintlify / Mintlify Validation (projectdiscovery) - vale-spellcheck

templates/protocols/code.mdx#L63

Did you really mean 'Matchers'?

| Value | Description |
| -------- | ---------------------------------------------------- |
Expand Down Expand Up @@ -99,10 +114,11 @@

## Args

Args are arguments that are sent to engine while executing the code. For example if we want to bypass execution policy in powershell for specific template this can be done by adding following args to the template.

Check warning on line 117 in templates/protocols/code.mdx

View check run for this annotation

Mintlify / Mintlify Validation (projectdiscovery) - vale-spellcheck

templates/protocols/code.mdx#L117

Did you really mean 'powershell'?

```yaml
- engine:
- pwsh
- powershell
- powershell.exe
args:
Expand Down Expand Up @@ -151,7 +167,7 @@

```

Below is a example code template where we are executing a powershell script while customizing behaviour of execution policy and setting pattern to `*.ps1`

Check warning on line 170 in templates/protocols/code.mdx

View check run for this annotation

Mintlify / Mintlify Validation (projectdiscovery) - vale-spellcheck

templates/protocols/code.mdx#L170

Did you really mean 'powershell'?

```yaml
id: ps1-code-snippet
Expand All @@ -166,6 +182,7 @@

code:
- engine:
- pwsh
- powershell
- powershell.exe
args:
Expand Down Expand Up @@ -193,6 +210,8 @@
nuclei -t code-template.yaml -code
```



## Learn More

<Info>
Expand Down
Loading