Proposed Changes
- Nuclei Fuzzing module already supports postfix,prefix,infix,replace rules, which specify how to handle new payload value, but sometimes exact value may not be known while replacing .
Ex: replacing a numerical value in path with a sqli payload, while this can't be achieved using replace directly because it will replace complete path at once ( and path is not known earlier) but this can now be achieved using this
fuzzing:
- part: path
type: replace-regex
mode: single
replace-regex: '/(.*?/)([0-9]+)(/.*)?'
fuzz:
- '/${1}${2}{{pathsqli}}${3}'