<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: writing-file-detection-templates
description: >-
  Write Nuclei file protocol templates for detecting vulnerabilities in
  local files. Covers configuration audits, secret detection, permission
  checks, binary analysis, and compliance scanning on filesystem targets.
domain: cybersecurity
subdomain: nuclei-templating
tags:
  - nuclei
  - file
  - local
  - config-audit
  - secrets
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1083"]
---

# Writing File Detection Templates

## Overview

File protocol templates scan local filesystem targets for misconfigurations,
exposed secrets, insecure permissions, and compliance violations. They enable
host-level security auditing without network interaction — ideal for CIS
benchmark checks and post-compromise assessment.

Mode: `[MODE: BLUE]` — Local file security auditing and compliance checking.

## Prerequisites

| Requirement | Details |
|---|---|
| Nuclei v3+ with file protocol support | Required |
| Read access to target files and directories | Required |
| Target file paths or patterns | Required |

## Key Concepts

### Basic File Content Check

```yaml
id: ssh-config-weak-ciphers

info:
  name: SSH Weak Cipher Configuration
  author: nerf
  severity: medium
  description: |
    Detects weak cipher algorithms configured in SSH server configuration
    that could allow cryptographic attacks on encrypted sessions.
  classification:
    cwe-id: CWE-327
  tags: ssh,crypto,misconfig,file,cis
  metadata:
    max-request: 1

file:
  - extensions:
      - all
    path:
      - "/etc/ssh/sshd_config"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "arcfour"
          - "3des-cbc"
          - "blowfish-cbc"
          - "cast128-cbc"
        condition: or
      - type: word
        words:
          - "Ciphers"
    extractors:
      - type: regex
        regex:
          - 'Ciphers\s+(.+)'
```

### Secret Detection in Files

```yaml
id: exposed-api-keys

info:
  name: Exposed API Keys in Configuration Files
  author: nerf
  severity: high
  description: |
    Detects hardcoded API keys, tokens, and credentials in configuration
    and source files that could enable unauthorized access.
  classification:
    cwe-id: CWE-798
  tags: secrets,api-key,exposure,file
  metadata:
    max-request: 1

file:
  - extensions:
      - yaml
      - yml
      - json
      - env
      - conf
      - cfg
      - ini
      - properties
    matchers-condition: or
    matchers:
      - type: regex
        regex:
          - '(?i)(aws_access_key_id|aws_secret_access_key)\s*[=:]\s*\S+'
          - '(?i)(api[_-]?key|apikey)\s*[=:]\s*["\x27]?\w{20,}["\x27]?'
          - 'AKIA[0-9A-Z]{16}'
          - '(?i)(password|passwd|pwd)\s*[=:]\s*["\x27]?\S{8,}["\x27]?'
          - 'ghp_[a-zA-Z0-9]{36}'
          - 'sk-[a-zA-Z0-9]{20,}'
    extractors:
      - type: regex
        regex:
          - '(?i)((?:api[_-]?key|password|secret|token)\s*[=:]\s*\S+)'
```

### Directory Permission Audit

```yaml
id: world-writable-directories

info:
  name: World-Writable Directory Detection
  author: nerf
  severity: medium
  description: |
    Detects world-writable directories that could allow unauthorized
    file creation or modification by any user.
  classification:
    cwe-id: CWE-732
  tags: permissions,filesystem,cis,file
  metadata:
    max-request: 1

file:
  - extensions:
      - all
    path:
      - "/tmp"
      - "/var/tmp"
      - "/dev/shm"
    matchers:
      - type: dsl
        dsl:
          - 'contains(raw, "drwxrwxrwx") || contains(raw, "drwxrwxrwt")'
```

### Docker Configuration Audit

```yaml
id: docker-socket-exposed

info:
  name: Docker Socket Exposed
  author: nerf
  severity: critical
  description: |
    Docker daemon socket is accessible, potentially allowing container
    escape and host-level privilege escalation.
  classification:
    cwe-id: CWE-269
  tags: docker,container,privesc,file
  metadata:
    max-request: 1

file:
  - extensions:
      - all
    path:
      - "/var/run/docker.sock"
    matchers:
      - type: dsl
        dsl:
          - 'len(raw) >= 0'
    extractors:
      - type: dsl
        dsl:
          - '"Docker socket exists and is accessible"'
```

### Kubernetes Secret Detection

```yaml
id: k8s-secrets-plaintext

info:
  name: Kubernetes Plaintext Secrets
  author: nerf
  severity: high
  classification:
    cwe-id: CWE-312
  tags: kubernetes,secrets,plaintext,file
  metadata:
    max-request: 1

file:
  - extensions:
      - yaml
      - yml
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "kind: Secret"
      - type: regex
        regex:
          - 'data:\s*\n(\s+\w+:\s*\S+\n)+'
      - type: word
        negative: true
        words:
          - "sops:"
          - "encrypted"
```

## Workflow

### Step 1: Scan Local Files

```bash
node scripts/agent.js --action scan --path /etc \
  --template file-template.yaml --output /tmp/file-scan.json
```

### Step 2: Validate Template

```bash
node scripts/agent.js --action validate --template file-template.yaml
```

## Verification

- [ ] Template uses `file` protocol (not `http`)
- [ ] File extensions properly scoped to relevant file types
- [ ] Paths are absolute or use appropriate glob patterns
- [ ] Regex patterns tested against real configuration samples
- [ ] False positive exclusions for commented-out lines
- [ ] Permissions required to read target files documented
- [ ] Tested on both affected and clean configurations

## References

- [Nuclei File Protocol](https://docs.projectdiscovery.io/templates/protocols/file)
- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
