HackBlue

Tools · Attack surface inventory · 19 / 23

Nuclei: matched-at can be a path the template added

The URL you passed is not always the URL that matched. matched-at is the request the template made, which may add a path. Write matched-at. Do not say the site root matched if the result names a longer URL.

11 min read · practice only with authorization

The template chooses the request

You can pass a site root. A template can request that root plus a path. The result’s matched-at value is the URL the template used. If that URL ends in a path you did not type, the match is about that path, not about the bare host.

Filing “the homepage matched” when matched-at is the homepage plus /login attributes the result to the wrong request.

Keep the input next to matched-at

Write the target you passed and the matched-at URL. If they differ, say the template added the extra path. If they are the same, say so. Do not drop the input and then forget whether the template widened it.

A template id still names which check ran. The URL says where. Both stay on the note. Severity remains the template’s label, not a reason to change the URL.

What to file

File the template id, the input URL, and matched-at. If you opened a browser, write the URL you opened, and make it the matched-at URL when that is the one that matched. Do not open only the site root and call that a confirmation.

Worked case: a root filed for a login path

The lab command targeted https://status.hackblue-lab.org. The result’s template id is hb-login-missing-hsts and matched-at is https://status.hackblue-lab.org/login. A draft says the status homepage is missing a header. The homepage was not the URL in matched-at.

The note quotes the input and matched-at. The match is the login path the template requested. The homepage is not described as the failure. Opening the result means opening the login URL, not only the root.

Snippet
input: https://status.hackblue-lab.org
template-id: hb-login-missing-hsts
matched-at: https://status.hackblue-lab.org/login
write: the template added /login
not: the homepage matched

Diagram

Compare the URL you passed with matched-at

  1. Input

    The target you gave the run.

    Command
    https://status.hackblue-lab.org
  2. matched-at

    The URL the template requested.

    Result
    …/login
  3. Differ

    Say the template added a path.

    Note
    the match is that path
  4. Open

    Confirm at matched-at, not only at the root.

    Check
    do not swap them

Check yourself

1. You passed a site root and matched-at ends in /login. What matched?

2. Why keep the input URL if matched-at is longer?

3. You open only the site root and it looks fine. What did you confirm?