Nuclei
Description
Nuclei is a fast, template based vulnerability scanner focusing on extensive configurability, massive extensibility and ease of use.
Attachment: dist.zip
Flag
TCP1P{W00h00_nuclei_can_detect_my_website!!!}
Solution
Creating vulnerable application to match Nuclei template.
app.py
from flask import Flask
app = Flask(__name__)
resp = """
"version":"10.0.5"
"Name":"TCP1P"
"msg":"success"
<script>alert(1)</script>
TCP1P{a}
"""
@app.route("/api/v1/version/")
def hello_world():
return resp
@app.route("/api/v2/echo/")
def test():
return resp
$ python3 -m venv venv
$ . ./venv/bin/activate
$ pip install Flask
(snip)
$ flask --app app run --host 0.0.0.0 --port 8080
* Serving Flask app 'app'
* Debug mode: off
WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.
* Running on all addresses (0.0.0.0)
* Running on http://127.0.0.1:8080
* Running on http://192.168.0.104:8080
Press CTRL+C to quit
34.126.162.59 - - [15/Oct/2023 12:33:44] "GET /api/v1/version/ HTTP/1.1" 200 -
34.126.162.59 - - [15/Oct/2023 12:33:44] "GET /api/v2/echo/?name=<script>alert(1)</script>&file=/etc/passwd HTTP/1.1" 200 -
In my case, when using Ngrok, Nuclei on the server could not connect to Vulnerable Application in my machine due to Ngrok Browser Warning. So, I used the port forwarding function of my home router to temporarily connect to the local machine and access it from Nuclei.