Hello everyone and welcome to this lesson.
As we are seeing file based templates and
we have seen how macher Works in this
lesson. We are going to see how extractor works.
This is basically that you want to match a specific
word and extract it as well.
For example, if you are matching API key,
I want to extract the API key
from the file as well. Not only the word API key.
This can be super useful to identify secret
or hidden sensitive
information that have been hard coded
generally into source code.
So extractors are the keywords that extract some
content from the provided files.
There are two types of extractors. The first one is the word and
the second one is Rejects.
Both extractors extract from the
entire request and response that we are going to send.
So it is the Practical time and let's jump on
the practical.
Here you can see I have written a file extracted.yml
template.
As you can see over here the ID block
and the information block Remains the Same.
Here in the file block we can see I'm matching
for the extensions which are only txt.
The Mac size is 1024 and here
instead of matcher. We have specified as
extractors. We are extracting a Rejects and
this is the specified rejects that we have supplied.
If you are not familiar with how rejects works, you can
simply go to this website, which is rejects 101.com and
you can paste your reach X over here.
Here we can see.
this matches the character a
here A to Z means it matches a
single character in the range between a to z.
And 4 is a quantifier which matches the
previous token value exactly four times.
Let's run this and see what is
the output that we will receive.
So I'm going to go to my terminal and quickly.
I'm going to change the template that we
want to run.
We have written a file extracted template and we
are going to supply it to nuclei and our Target
is going to be the folder which is files.
Let's hit enter and let's wait.
You can see over here. We are able to successfully extract
the word as well, which is Apple.
Similarly, you would be able to extract more
sensitive information that you want from the
files as well.
For demonstration, let us take an example of this.
I'm going to download this GitHub repository which is known as
GitHub leak which contains a secret.js
file and which also contains the
secret dot yml file which contains some information over
here that might be useful for me.
So I'm going to quickly get clone this into this path.
And let us run the file extracted template once
again, but this time on GitHub leak
folder.
Before we start running this we will make a small change because
we are only matching extensions of
txt. Let's change that to all.
Let's run this once more.
And you can see once we run it we are
able to identify these places as
matched in the
GitHub League folder inside these files
as can be seen from here.
Thank you.