Split Nuclei cascade into two

malexmave · malexmave · commit 0d940089e052 · 2022-01-10T15:44:39.000+01:00
The nuclei rule had problems because it omitted the protocol and port
information. This commit splits it into two separate rules, one for
http and one for https. This should make it more robust.

Signed-off-by: Max Maass &lt;max.maass@iteratec.com&gt;
diff --git a/scanners/nuclei/cascading-rules/subdomain_http.yaml b/scanners/nuclei/cascading-rules/subdomain_http.yaml
@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: "cascading.securecodebox.io/v1"
+kind: CascadingRule
+metadata:
+  name: "nuclei-subdomain-scan-light-http"
+  labels:
+    securecodebox.io/invasive: non-invasive
+    securecodebox.io/intensive: light
+spec:
+  matches:
+    anyOf:
+      - category: "Open Port"
+        attributes:
+          port: 80
+          state: open
+      - category: "Open Port"
+        attributes:
+          service: "http"
+          state: open
+      - category: "Open Port"
+        attributes:
+          service: "http-*"
+          state: open
+      
+  scanSpec:
+    scanType: "nuclei"
+    parameters:
+      # Target domain name of the finding and start a nuclei scan
+      - "-u"
+      - "http://{{$.hostOrIP}}:{{attributes.port}}"
diff --git a/scanners/nuclei/cascading-rules/subdomain_https.yaml b/scanners/nuclei/cascading-rules/subdomain_https.yaml
@@ -5,18 +5,28 @@
 apiVersion: "cascading.securecodebox.io/v1"
 kind: CascadingRule
 metadata:
-  name: "nuclei-subdomain-scan-light"
+  name: "nuclei-subdomain-scan-light-https"
   labels:
     securecodebox.io/invasive: non-invasive
     securecodebox.io/intensive: light
 spec:
   matches:
     anyOf:
-      - category: "Subdomain"
-        osi_layer: "NETWORK"
+      - category: "Open Port"
+        attributes:
+          port: 443
+          state: open
+      - category: "Open Port"
+        attributes:
+          service: "https"
+          state: open
+      - category: "Open Port"
+        attributes:
+          service: "https*"
+          state: open
   scanSpec:
     scanType: "nuclei"
     parameters:
       # Target domain name of the finding and start a nuclei scan
       - "-u"
-      - "{{location}}"
+      - "https://{{$.hostOrIP}}:{{attributes.port}}"
