Combining static file analysis and dynamic HTTP requests ?

[mathis2001]

Hello,

I use custom Nuclei templates for android apps static analysis and I am actually trying to write a script to extract firebase domains from source code / resources and send a request to https://.firebaseio.com/.json to check for read access.

The problem is that the HTTP request and file extract seems to work independently and I don't know if it is because my template isn't good or if nuclei can't combine this two things.

Is there any way to do such checks with a single nuclei template ?

Here is my template:

id: firebase-exploit

info:
  name: Detect and exploit Firebase and Appspot broken access.
  author: S1rN3tZ
  severity: info
  description: |
    This template detects Firebase and Appspot URLs in APK files and verifies if the extracted URLs with a `.json` appended return valid responses.

file:
  - extensions:
      - all

    extractors:
      - type: regex
        name: firebase_domain
        regex:
          - '(\b[a-zA-Z0-9][a-zA-Z0-9-_]*\.)*firebaseio\.com\b'
          - '(\b[a-zA-Z0-9][a-zA-Z0-9-_]*\.)*appspot\.com\b'

http:
  - raw:
      - |
        GET /.json HTTP/1.1
        Host: {{firebase_domain}}

    matchers:
      - type: status
        status:
          - 200

    matchers-condition: and
    stop-at-first-match: true

And here is an example of result:

[INF] Current nuclei version: v3.4.4 (latest)
[INF] Current nuclei-templates version: v10.2.2 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 65
[INF] Templates loaded for current scan: 1
[WRN] Loading 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[INF] Running httpx on input host
[INF] Found 0 URL from httpx
[firebase-exploit:firebase_domain] [file] [info] res/values/strings.xml ["xxxxxxxx.firebaseio.com"]
[firebase-exploit:firebase_domain] [file] [info] smali_classes4/com/google/firebase/database/core/RepoInfo.smali ["firebaseio.com"]
[INF] Scan completed in 37.176736901s. 2 matches found.

[acaetano]

Use a workflow for that. Or ask the AI companion at the nuclei website, in the search box. Type your question and hit the last option that appears.