BaseURL has encoded URL characters that are being decoded by Nuclei #6173

egru · 2025-04-14T19:33:37Z

egru
Apr 14, 2025

I'm trying to test a local file include template where the BaseURL includes the encoded path to the file in question. For example: https://example.com:443/%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fetc/passwd

However, Nuclei is decoding the URL path and sending it off, which doesn't trigger the vulnerability. Is there a way I can have the BaseURL variable not modify the URL it's given?

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: regex
        regex:
          - "root:.*:0:0"

[INF] [local-file-include] Dumped HTTP request for https://example.com:443/../../../../../../../../../../../etc/passwd

GET /../../../../../../../../../../../etc/passwd HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (SS; Linux i686; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Accept: */*
Accept-Language: en

[DBG] [local-file-include] Dumped HTTP response https://example.com:443/../../../../../../../../../../../etc/passwd/

HTTP/1.1 400 Bad Request
Connection: close
Content-Length: 122
Content-Type: text/html
Date: Mon, 14 Apr 2025 19:29:13 GMT

<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
</body>
</html>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ProjectDiscovery

BaseURL has encoded URL characters that are being decoded by Nuclei #6173

{{title}}

Replies: 0 comments

Select a reply

ProjectDiscovery

BaseURL has encoded URL characters that are being decoded by Nuclei #6173

egru Apr 14, 2025

Replies: 0 comments

egru
Apr 14, 2025