Alright, so hello everyone. So in the previous lesson
we have seen how we were able to run a nuclei
version detect template on to our
Target which helped us identify the
specific nginx version for the specific
URL that we supplied.
Now, let's see the template of
how it works.
We are going to see in depth about how you can
write your own template as well based on
different blocks.
But let us get in.
Quick overview about this template so you
can see over here. The template has an ID
block, which is nginx version has a info block
which you can see.
Has these details like name author severity description and
tags has a request block with specifies
the method of the HTTP request
that is going to be sent. It could be get post
Etc the base URL that
is going to be supplied. Remember the base URL is
the URL of your target that you supply on
the command line to nuclei.
The matches condition is and which means there are going
to be two conditions for nuclei to
be matching.
The matches condition is and that means there were two conditions.
That should match successfully to give you an output.
The matches block says they should be a type
rejects, which means we want to extract something from the header.
The rejects is nginx slash 0 to
9 Dot
Then we are going to match something in the status, which is the status code, which
should be 200. Okay, and finally the extractors.
Due to extractors we were able to extract that information
which we have matched previously and show
it as output on our terminal and we
can see we are extracting the nginx version
based on the rejects from the header.
Let's go back over here and we can see we are able to extract the
engine X version from the header.
Let us now. Also extract the
PHP version as we can see over here.
So let us quickly write a quick template to see
if we can also write a valid template
to extract this information.
So I'm going to go back over here and I'm going to copy
this template as a base template right now.
So I'm going to copy the raw version of this template and
I'm going to paste it into any editor that
you have. I'm going to use Sublime.
I'm going to paste it over here.
Let us save this with the name.
Let's give a name as PHP detect Dot yaml.
Now let us modify that this time
we don't want to match nginx, but we are interested
in identifying the PHP version. So let's change
this to PHP.
We also want to extract the PHP version
from there.
Also, let's modify the template name, let's call
it as PHP version detect this time
Let's modify this as well and let's keep everything
else as it is.
And I think it's good to go.
Now keep in mind whenever you create templates or
modify existing templates.
You might create mistakes in the template. So
this is one of the very good
resource that you can go and check if your
template contains any error or no.
I'm going to hit go and check if you see a green message
like this, which says valid. Yml. That means
your template is correct to be used.
Do not worry. We are going to understand more about template Creation in
depth in the future sessions.
I'm going to copy this template right now. I'm going to go to
my terminal and I'm going to create a file called as PHP
hyphen detect Dot. Yml.
There's already a template so I'm going to delete everything from here quickly.
And paste what we have created just now
now I'm going to run this template
on my Target and hit enter.
We are expecting this template to run correctly and extract out
the PHP version for us.
And you can see that template has successfully ranked correctly
the first reach access matched correctly PHP
version 5.6.40. Let's
verify if this information is correct.
And you can see PHP version 5.6.40 is
absolutely correct, which means the
first template that we created as a baseline to
identify the PHP version was correct.
The second match a condition was the status code which has matched
correctly as well.
Let us crawl up and see this.
You can see it has been highlighted in green color
what we are currently trying to match.
This was the HTTP request that was sent similarly.
This was the HTTP response that we received and
correctly matched the matcher condition
that we gave in our template.
I hope you guys understood this that how you can quickly write your first
template validate the template from ymlint and
then run it onto your target.
It is so useful and super simple
to write your templates like this. Also, you can
add complex templates as well that
can help you automate most of your Works while
you are doing research on your bug Bounty programs.
Thank you.