Multiple bug fixes in query param fuzzing

[tarunKoyalwar]

Proposed Changes

• fuzz: check and handle typed slice
• do not query encode params + fuzz/allow duplicates params
• use ordered params and maintain query param order
• allow optional support for fuzzing duplicated param using indexes _1 , _2 . see

  nuclei/pkg/fuzz/dataformat/form.go

  Lines 23 to 33 in f1fc62e

  	// == Handling Duplicate Query Parameters / Form Data ==
  	// Nuclei supports fuzzing duplicate query parameters by internally normalizing
  	// them and denormalizing them back when creating request this normalization
  	// can be leveraged to specify custom fuzzing behaviour in template as well
  	// if a query like `?foo=bar&foo=baz&foo=fuzzz` is provided, it will be normalized to
  	// foo_1=bar , foo_2=baz , foo=fuzzz (i.e last value is given original key which is usual behaviour in HTTP and its implementations)
  	// this way this change does not break any existing rules in template given by keys-regex or keys
  	// At same time if user wants to specify 2nd or 1st duplicate value in template, they can use foo_1 or foo_2 in keys-regex or keys
  	// Note: By default all duplicate query parameters are fuzzed
  	type Form struct{}

[tarunKoyalwar]

Before

$  nuclei -u "https://example.com/test/view.action?ids=AA&ids=BB&ids=CC&ids=DD" -t ~/fuzzing-templates/xss/reflected-xss.yaml -fuzz -debug-req 

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.2.2

		projectdiscovery.io

[INF] Current nuclei version: v3.2.2 (latest)
[INF] Current nuclei-templates version: v9.7.8 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 126
[INF] Templates loaded for current scan: 1
[WRN] Loaded 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[ERR] unknown type []string for value [AA BB CC DD]
[INF] [reflected-xss] Dumped HTTP request for https://example.com/test/view.action

GET /test/view.action HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

[ERR] unknown type []string for value [AA BB CC DD]
[INF] No results found. Better luck next time!

After fix / Improvements

$  ./nuclei -u "https://example.com/test/view.action?ids=AA&ids=BB&ids=CC&ids=DD" -t ~/fuzzing-templates/xss/reflected-xss.yaml -fuzz -debug-req

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.2.2

		projectdiscovery.io

[INF] Current nuclei version: v3.2.2 (latest)
[INF] Current nuclei-templates version: v9.7.8 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 126
[INF] Templates loaded for current scan: 1
[WRN] Loaded 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[INF] [reflected-xss] Dumped HTTP request for https://example.com/test/view.action?ids=AA'"><64250&ids=BB&ids=CC&ids=DD

GET /test/view.action?ids=AA'"><64250&ids=BB&ids=CC&ids=DD HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

[INF] [reflected-xss] Dumped HTTP request for https://example.com/test/view.action?ids=AA&ids=BB'"><64250&ids=CC&ids=DD

GET /test/view.action?ids=AA&ids=BB'"><64250&ids=CC&ids=DD HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

[INF] [reflected-xss] Dumped HTTP request for https://example.com/test/view.action?ids=AA&ids=BB&ids=CC'"><64250&ids=DD

GET /test/view.action?ids=AA&ids=BB&ids=CC'"><64250&ids=DD HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

[INF] [reflected-xss] Dumped HTTP request for https://example.com/test/view.action?ids=AA&ids=BB&ids=CC&ids=DD'"><64250

GET /test/view.action?ids=AA&ids=BB&ids=CC&ids=DD'"><64250 HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

[INF] No results found. Better luck next time!