jaeles-project/jaeles

Is "Body" works as intended?

Sh1Yo opened this issue · 3 comments

Sh1Yo commented

As we can see in the docs:

Header() and Body() have same usage of Query() generator.

- Query("{{.payload}}", "{{.name}}") works fine, but
- Body("{{.payload}}", "{{.name}}") just ignored.
I tried to set the method to POST, but anyways it doesn't work
My config is -

id: ci-fuzz-01
info:
  name: Command Injection Reflection
  risk: High
payloads:
- 'echo TJEGSE$((2314+6548321))$(echo TJEGSE)TJEGSE' 
requests:
- detections:
  - StringSearch("response", "6550635") && (StringCount("response", "6550635") > StringCount("oresponse",
    "6550635"))
  generators:
  - Body("{{.payload}}", "{{.name}}")
type: fuzz
variables:
- name: 'cmd

'

This look like a bug let me investigate and let you know.

Body("{{.payload}}") this should works. Because I do not support body select param yet

Sh1Yo commented

Okay, but I think that select param for Body is a necessary option so I will leave the issue open until you add it.