天主视角：寻找网站源码

学习这个用法就我个人而言最大的好处是，遇到返回大量数据的时候，可以根据一些特点来过滤掉一些垃圾数据。

                               
登录/注册后可看大图

                               
登录/注册后可看大图

                               
登录/注册后可看大图

                               
登录/注册后可看大图

                               
登录/注册后可看大图

                               
登录/注册后可看大图

                               
登录/注册后可看大图

                               
登录/注册后可看大图

                               
登录/注册后可看大图

                               
登录/注册后可看大图

1.HTTP Requests start with a request block which specifies the start of the requests for the template.
2.Request method can be GET, POST, PUT, DELETE, etc depending on the needs.
3.Redirection conditions can be specified per each template. By default, redirects are not followed. However, if desired, they can be enabled with redirects: true in request d etails.
4.The next part of the requests is the path of the request path. Dynamic variables can be placed in the path to modify its behavior on runtime.
Variables start with {{ and end with }} and are case-sensitive.
{{b aseURL}} - This will replace on runtime in the request by the original URL as specified in the target file.
{{Hostname}} - Hostname variable is replaced by the hostname of the target on runtime.
5.Headers can also be specified to be sent along with the requests. Headers are placed in form of key/value pairs. An example header configuration looks like this:
# headers contains the headers for the requestheaders: # Custom user-agent header User-Agent: Some-Random-User-Agent # Custom request origin Origin: https://google.com
6.Body specifies a body to be sent along with the request. (发送POST包需要用到)
7.To maintain cookie b ased browser like session between multiple requests, you can simply use cookie-reuse: true in your template, Useful in cases where you want to maintain session between series of request to complete the exploit chain and to perform authenticated scans.(Session重用，作用是串联攻击链，实现登录验证再攻击)
# cookie-reuse accepts boolean input and false as defaultcookie-reuse: true
8.Request condition allows to check for condition between multiple requests for writing complex checks and exploits involving multiple HTTP request to complete the exploit chain.
with DSL matcher, it can be utilized by adding req-condition: true and numbers as suffix with respective attributes, status_code_1, status_code_3, andbody_2 for example.(编写复杂攻击链)
req-condition: true matchers: - type: dsl dsl: - "status\_code\_1 == 404 && status\_code\_2 == 200 && contains((body\_2), 'secret\_string')"
…还有许多高级用法比如支持raw http，race之类的，但是这里用不上，文档这个东西，够用就行。

Multiple matchers can be specified in a request. There are basically 6 types of matchers:
status(状态码) size(返回包巨细) word(字符串) regex(正则匹配) binary(二进制文件)
还有一个dsl，高度自定义验证返回内容，可以对返回内容做一些操作(这里暂时用不上)
可用的辅助函数: https://nuclei.projectdiscovery.io/templating-guide/helper-functions/,
对于words and regexes,可以对返回内容的多个匹配条件用AND或OR举行组合。
Multiple words and regexes can be specified in a single matcher and can be configured with different conditions like AND and OR
可以对返回的包，选定match的地区，默认是body，也支持选择header等任意地方。
Multiple parts of the response can also be matched for the request, default matched part is body if not defined.
支持对条件取反，这个就是反证法的妙处了。
All types of matchers also support negative conditions, mostly useful when you look for a match with an exclusions. This can be used by adding negative: true in the matchers block.
支持使用多个matchers
Multiple matchers can be used in a single template to fingerprint multiple conditions with a single request.
支持matchers-condition
While using multiple matchers the default condition is to follow OR operation in between all the matchers, AND operation can be used to make sure return the result if all matchers returns true.

                               
登录/注册后可看大图

                               
登录/注册后可看大图

                               
登录/注册后可看大图