Inquiry: Query String Fuzzing with POST Requests

[m4urel]

Hi,

I have a question regarding the current capabilities of Nuclei. Specifically, I am looking to perform fuzzing on query string parameters using a POST request, where the fuzzed query string parameters would be placed in the body of the POST request.

When executing a command such as:

nuclei -t template.yaml -u http://example.com/?param1=val1&param2=val2 -dast

Is there currently a way to fuzz the query string parameters param1=val1&param2=val2 and have them included in the body of a POST request, similar to how fuzzing is done with GET requests?

Currently, using a template like the following:

id: test

info:
  name: test
  author: foo
  severity: info
  description: description

requests:
  - method: POST
    path:
      - "{{BaseURL}}"
    
    payloads:
      payload:
        - "test"

    fuzzing:
      - part: query
        type: postfix
        mode: single
        fuzz:
          - "{{payload}}"

The fuzzing is performed using the GET method, and the query string parameters param1=val1&param2=val2 are fuzzed as part of the URL, even when using the - method: POST directive. Additionally, it would be helpful to have a generic variable like {{QueryString}} to directly access the query string within the template.

Thank you for your time and assistance!