Nuclei v3.8.0

v3.8.0
Added 5
  • Add XSS reflection context analyzer to fuzz module
  • Add PDF export option for scan results
  • Support service names in port field for network templates
  • Add honeypot detection to reduce scan noise
  • Add inline targets and secrets to template profiles
Fixed 13
  • Respect annotations in unsafe mode for HTTP requests
  • Isolate project cache keys by scheme and host
  • Propagate unresolved variable markers through encoding functions
  • Respect WithOptions rate limit in SDK
  • Prevent path mutation across sequential Rebuild calls in fuzz module
  • Use actual parameter for frequency deduplication in fuzz module
Security 2
  • Respect allow-local-file-access in require for JS templates
  • Only evaluate template-authored expressions to prevent unauthorized code execution
What's Changed
Security Fixes
Bug Fixes
  • HTTP: Respect annotations in unsafe mode by @dwisiswant0 (#7044)
  • HTTP: Isolate project cache keys by scheme & host by @dwisiswant0 (#7043)
  • Expressions: Propagate unresolved variable markers through encoding functions by @dogancanbakir (#7033)
  • SDK: Respect WithOptions rate limit by @dwisiswant0 (#7342)
  • Fuzz: Prevent path mutation across sequential Rebuild calls by @promisingcoder (#7253)
  • Fuzz: Use actual parameter for frequency deduplication by @Godzilla675 (#7037)
  • Fuzz: Fix concurrent map writes in multipart form parsing by @Mzack9999 (#7291)
  • Fuzz: Propagate custom headers to time_delay analyzer follow-up requests by @usernametooshort (#7125)
  • JS: Fix watchdog and propagate context to all JS library network calls by @Mzack9999 (#7299)
  • JS: Interrupt goja runtime on context cancel by @mikhail5555 (#7343)
  • WebSocket: Fix path handling when merging template & target URLs by @Mzack9999 (#7290)
  • Runner: Stop spawning template goroutines in host-spray when host is unresponsive by @usernametooshort (#7129)
  • Input: Optimize removeTargets to prevent hang on large exclusions by @JawsKim (#6760)
  • Installer: Prevent unnecessary update checks by @dahezhiquan (#7337)
  • Utils: Normalize unbracketed IPv6 literals for probing by @dwisiswant0 (#7045)
  • Client pool: Replace global variable with local scoping by @mikhail5555 (#7294)
  • Fix InFlight map race condition via Snapshot method by @n3integration (#7026)
  • Fix race condition in Dynamic.Fetch and always prefetch secrets by @hussain-alsaibai (#6976)
  • Fix nil interface set in createEphemeralObjects to prevent panic by @maxwolf8852 (#6944)
  • Fix DAST skipping URLs with part: request and mode: multiple by @dogancanbakir (#7326)
  • Fix headless JS loading with -tlsi and addheader/setheader by @dogancanbakir (#7325)
  • Fix flow execution with auth by @Mzack9999 (#7298)
  • Fix redirect handling by @Mzack9999 (#7286)
  • Fix Elastic export by @Mzack9999 (#7287)
  • Use crypto/rand instead of math/rand in JS global functions by @sandiyochristan (#7215)
New Features
  • Fuzz: Add XSS reflection context analyzer by @ZachL111 (#7164)
  • Reporting: Add PDF export option for scan results by @Gengyscan (#7254)
  • Network templates: Support service names in port field by @dogancanbakir (#7303)
  • Add honeypot detection to reduce scan noise by @HarshadaGawas05 (#7277)
  • Add inline targets and secrets to template profiles by @SaurabhCodesAI (#6858)
Performance & Improvements
  • Runner: Fast path for tag listing by @dwisiswant0 (#7143)
  • Runner: Use Print instead for listAvailableStoreTags by @dwisiswant0 (#7145)
  • Resume state: Refactored as cache data by @dwisiswant0 (#7042)
  • Capture stderr output by @Mzack9999 (#7292)
Tests & CI
  • Add fuzz tests by @dwisiswant0 (#7311)
  • Add request condition tests for multi-raw-request flow templates by @Mzack9999 (#7300)
  • Refactor native tests by @dwisiswant0 (#7307)
  • Add GITHUB_TOKEN to workflows for authenticated template updates by @dwisiswant0 (#7119)
  • Integrate typos spell checker into CI by @telewin95 (#7158)
Documentation
  • Update outdated documentation links across all translations by @Pitrat-wav (#7020)
New Contributors

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.7.1...v3.8.0

View original

Upgraded? How did it go?

Discussion