nuclei&pythoncode

[vkusrorof]

https://docs.projectdiscovery.io/templates/protocols/code

Currently, I have identified a vulnerability that requires verification; however, the process involves several cumbersome steps. I attempted to generate a YAML configuration using a Python script based on the official documentation, but the implementation failed to execute. Additionally, the -sign signature method described in the guide did not produce the expected results.

id: mtoken-generate-demo

info:
  name: mToken generator from security.key
  author: chatgpt
  severity: info

http:
  - id: step1
    method: GET
    path:
      - "{{BaseURL}}"

    extractors:
      - type: regex
        name: securitykey
        part: body
        group: 1
        regex:
          - "security.key':\"(.*?)\""
code:
  - id: step2
    engine:
      - py
      - python3
    source: |
      print("Hello World")

[vkusrorof]

@dogancanbakir Could you please confirm whether this is the correct channel for submission?

STEP1，get the security.key
STEP2，use security.key to python create mToken

python code:

import hashlib
import time
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad

def encrypt(data, seed_str):
    seed = seed_str.encode('utf-8')
    first_hash = hashlib.sha1(seed).digest()
    key_bytes = hashlib.sha1(first_hash).digest()[:16]
    cipher = AES.new(key_bytes, AES.MODE_ECB)
    plaintext = data.encode('utf-8')
    padded = pad(plaintext, AES.block_size)
    ciphertext = cipher.encrypt(padded)
    return ciphertext.hex().upper()

if __name__ == "__main__":
    data = "1;1;" + str(int(time.time() * 1000))
    seed = "**{{security.key}}**"
    print(encrypt(data, seed))

STEP3, used mToken send http requests