Request Character Encoding Problem in Nuclei Fuzzing

[OmarKhaled511]

Hi,

I am using this template, and the payloads in the file contain the character '%'. When I start fuzzing, Nuclei will Url Encode this character, but I want the request to be sent as is, without encoding

id: mis-detect

info:
  name: mis Detect
  author: bate5a
  severity: info
  reference:
    - https://wordpress.org/bate5a



http:
  - method: GET

    path:
      - "{{BaseURL}}/{{path}}"

    payloads:
      path: payloadss.txt


    extractors:
      - type: regex
        regex:
          - 'Hi'

[OmarKhaled511]

@ehsandeep could you help ?

[ehsandeep]

@OmarKhaled511 you can use unsafe: true, for example - https://templates.nuclei.sh/public/CVE-2023-38035

[OmarKhaled511]

@ehsandeep , I tried using unsafe: true and the {{url_decode}} function, but neither of them worked. I am using the latest version of Nuclei. When the template fuzzes the root directory /fuzz, it encodes the characters. However, if I add a parameter in the Nuclei template, it works fine and does not encode the characters. For example, - "{{BaseURL}}/?param={{path}}". But when it comes to the root directory, it encodes it

example response From The Above Template

GET /%25 HTTP/1.1
Host: www.example.com
User-Agent: Go-http-client/1.1
Connection: close
Accept-Encoding: gzip