daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update generic-path-traversal.yaml

patch-1
Prince Chaddha 2023-06-28 10:41:36 +05:30 committed by GitHub
parent 5a98340f2b
commit 9a179323ff
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
file/nodejs/generic-path-traversal.yaml
View File

@ -14,26 +14,8 @@ file:
matchers:
- type: regex
regex:
- "function \\(\\$REQ, \\$RES, ...\\) {...}"
- "function \\$FUNC\\(\\$REQ, \\$RES, ...\\) {...}"
- "\\$X = function \\$FUNC\\(\\$REQ, \\$RES, ...\\) {...}"
- "var \\$X = function \\$FUNC\\(\\$REQ, \\$RES, ...\\) {...};"
- "\\$APP.\\$METHOD\\(..., function \\$FUNC\\(\\$REQ, \\$RES, ...\\) {...}\\)"
- "\\$X\\.createReadStream\\(..., <... \\$REQ\\.\\$QUERY\\.\\$VAR ...>, ...\\)"
- "\\$X\\.createReadStream\\(..., <... \\$REQ\\.\\$QUERY ...>, ...\\)"
- "\\$X\\.readFile\\(..., <... \\$REQ\\.\\$QUERY\\.\\$VAR ...>, ...\\)"
- "\\$X\\.readFile\\(..., <... \\$REQ\\.\\$QUERY ...>, ...\\)"
- "\\$X\\.readFileSync\\(..., <... \\$REQ\\.\\$QUERY\\.\\$VAR ...>, ...\\)"
- "\\$X\\.readFileSync\\(..., <... \\$REQ\\.\\$QUERY ...>, ...\\)"
- "\\$X\\.readFileAsync\\(..., <... \\$REQ\\.\\$QUERY\\.\\$VAR ...>, ...\\)"
- "\\$X\\.readFileAsync\\(..., <... \\$REQ\\.\\$QUERY ...>, ...\\)"
- "\\$INP = <... \\$REQ\\.\\$QUERY\\.\\$VAR ...>\\;"
- "\\$X\\.createReadStream\\(..., <... \\$INP ...>, ...\\)"
- "\\$INP = <... \\$REQ\\.\\$QUERY ...>\\;"
- "\\$X\\.readFile\\(..., <... \\$INP ...>, ...\\)"
- "\\$X\\.readFileSync\\(..., <... \\$INP ...>, ...\\)"
- "\\$Y = \\$REQ\\.\\$QUERY\\.\\$VAR\\;"
- "\\$INP = <... \\$Y ...>\\;"
- "\\$Y = \\$REQ\\.\\$QUERY\\;"
- "\\$X\\.readFileAsync\\(..., <... \\$INP ...>, ...\\)"
- "[^\\.]*\\.createReadStream\\([^\\)]*\\, <[\\s\\S]*?\\> [^\\)]*\\)"
- "[^\\.]*\\.readFile\\([^\\)]*\\, <[\\s\\S]*?\\> [^\\)]*\\)"
- "[^\\.]*\\.readFileSync\\([^\\)]*\\, <[\\s\\S]*?\\> [^\\)]*\\)"
- "[^\\.]*\\.readFileAsync\\([^\\)]*\\, <[\\s\\S]*?\\> [^\\)]*\\)"
condition: or