feat(input): pin a target to an ip with the ip key of target lines

go.mod

@@ -473,3 +473,5 @@ require (
 
 // https://go.dev/ref/mod#go-mod-file-retract
 retract v3.2.0 // retract due to broken js protocol issue
+
+replace github.com/projectdiscovery/fastdialer => github.com/projectdiscovery/fastdialer v0.5.26-0.20261013195407-11ed52b6df6c

go.sum

@@ -937,8 +937,8 @@ github.com/projectdiscovery/clistats v0.1.7 h1:NXf4lUzx1QcbJd6QycNwwYHTv2FsW9Mch
 github.com/projectdiscovery/clistats v0.1.7/go.mod h1:RxRGxhMzkT344VTTvZWIrojurUXdQQRN1yfwgg/88I8=
 github.com/projectdiscovery/dsl v0.8.24 h1:rN2w6LSIjA16qKGRjyj70oxdwXGaspe6sAjEkP7F2fk=
 github.com/projectdiscovery/dsl v0.8.24/go.mod h1:V+EludvS5PS19UNMlM3CuBwZ+sFnMaQhCFGxysDUanQ=
-github.com/projectdiscovery/fastdialer v0.5.26 h1:wCCsopLsO1EF1V1+9Wqkxj1bMm6sRo8NdlzwE2Ib2Ss=
-github.com/projectdiscovery/fastdialer v0.5.26/go.mod h1:dZzEPnpsxqCiD3IkM5CN3RglW3l1gXJNyTkxqjPZIbs=
+github.com/projectdiscovery/fastdialer v0.5.26-0.20261013195407-11ed52b6df6c h1:nWPzF0xe4LzMfSHllHbVzBxdAhwtusRisN091e049KI=
+github.com/projectdiscovery/fastdialer v0.5.26-0.20261013195407-11ed52b6df6c/go.mod h1:CZZ0PwdTw2KCI/PrZTW9wyBY88MIjpT8WhsKWSw3bkw=
 github.com/projectdiscovery/fasttemplate v0.0.2 h1:h2cISk5xDhlJEinlBQS6RRx0vOlOirB2y3Yu4PJzpiA=
 github.com/projectdiscovery/fasttemplate v0.0.2/go.mod h1:XYWWVMxnItd+r0GbjA1GCsUopMw1/XusuQxdyAIHMCw=
 github.com/projectdiscovery/freeport v0.0.7 h1:Q6uXo/j8SaV/GlAHkEYQi8WQoPXyJWxyspx+aFmz9Qk=

internal/runner/inputs.go

@@ -71,7 +71,10 @@ func (r *Runner) initializeTemplatesHTTPInput() (*hybrid.HybridMap, error) {
 		go func(input *contextargs.MetaInput) {
 			defer swg.Done()
 
-			if result := utils.ProbeURL(input.Input, httpxClient); result != "" {
+			// a pinned target is probed through its ip; a target pinned to
+			// several ips keeps one probe result for all of them
+			ctx := contextargs.WithCustomIP(context.Background(), input)
+			if result := utils.ProbeURLWithContext(ctx, input.Input, httpxClient); result != "" {
 				count.Add(1)
 				_ = hm.Set(input.Input, []byte(result))
 			}

internal/runner/runner.go

@@ -750,6 +750,14 @@ func (r *Runner) RunEnumeration() error {
 		}
 		loaderConfig.TargetFilter = profiles.LoadFilter()
 	}
+	if r.hasPinnedTargets() {
+		switch {
+		case r.options.AutomaticScan:
+			return errors.New("targets pinned to an ip cannot be combined with automatic scan")
+		case r.options.AliveHttpProxy != "" || r.options.AliveSocksProxy != "":
+			return errors.New("targets pinned to an ip cannot be combined with a proxy, as the proxy resolves the host itself")
+		}
+	}
 	if (!strings.EqualFold(r.options.InputFileMode, "list") || r.options.DAST) && !r.options.OfflineHTTP {
 		// if input type is not list (implicitly enable fuzzing), unless passive/offlinehttp
 		r.options.DAST = true

internal/runner/target_profiles.go

@@ -15,3 +15,11 @@ func (r *Runner) targetProfiles() *targetprofile.Registry {
 	}
 	return provider.TargetProfiles()
 }
+
+// hasPinnedTargets reports whether a target line pinned a target to an ip.
+func (r *Runner) hasPinnedTargets() bool {
+	provider, ok := r.inputProvider.(interface {
+		PinnedTargets() bool
+	})
+	return ok && provider.PinnedTargets()
+}

internal/tests/integration/http_test.go

@@ -6,6 +6,7 @@ package integration_test
 import (
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/http/httputil"
@@ -83,6 +84,7 @@ var httpTestcases = []integrationCase{
 	{Path: "protocols/http/annotation-timeout.yaml", TestCase: &annotationTimeout{}},
 	{Path: "protocols/http/custom-attack-type.yaml", TestCase: &customAttackType{}},
 	{Path: "protocols/http/get-all-ips.yaml", TestCase: &scanAllIPS{}},
+	{Path: "protocols/http/target-line-ip.yaml", TestCase: &httpTargetLineIP{}},
 	{Path: "protocols/http/get-without-scheme.yaml", TestCase: &httpGetWithoutScheme{}},
 	{Path: "protocols/http/cl-body-without-header.yaml", TestCase: &httpCLBodyWithoutHeader{}},
 	{Path: "protocols/http/cl-body-with-header.yaml", TestCase: &httpCLBodyWithHeader{}},
@@ -1606,6 +1608,70 @@ func (h *scanAllIPS) Execute(filePath string) error {
 	return expectResultsCount(got, 1)
 }
 
+// target lines pin a hostname that does not resolve to the test servers
+type httpTargetLineIP struct{}
+
+// Execute executes a test case and returns an error if occurred
+func (h *httpTargetLineIP) Execute(filePath string) error {
+	serve := func(addr, name string) (*httptest.Server, error) {
+		listener, err := net.Listen("tcp", addr)
+		if err != nil {
+			return nil, err
+		}
+		ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			_, _ = fmt.Fprintf(w, "host=%s server=%s", r.Host, name)
+		}))
+		_ = ts.Listener.Close()
+		ts.Listener = listener
+		ts.Start()
+		return ts, nil
+	}
+
+	one, err := serve("127.0.0.1:0", "one")
+	if err != nil {
+		return err
+	}
+	defer one.Close()
+	_, port, err := net.SplitHostPort(one.Listener.Addr().String())
+	if err != nil {
+		return err
+	}
+
+	lines := []string{fmt.Sprintf(`{"target": "http://pinned.test:%s", "ip": "127.0.0.1"}`, port)}
+	want := []string{"one"}
+	// the same host pinned to a second ip, where 127.0.0.2 is available
+	if two, err := serve(net.JoinHostPort("127.0.0.2", port), "two"); err == nil {
+		defer two.Close()
+		lines = append(lines, fmt.Sprintf(`{"target": "http://pinned.test:%s", "ip": "127.0.0.2"}`, port))
+		want = append(want, "two")
+	}
+
+	targets, err := os.CreateTemp("", "target-lines-*.txt")
+	if err != nil {
+		return err
+	}
+	defer func() { _ = os.Remove(targets.Name()) }()
+	if _, err := targets.WriteString(strings.Join(lines, "\n")); err != nil {
+		return err
+	}
+	_ = targets.Close()
+
+	got, err := testutils.RunNucleiBareArgsAndGetResults(debug, nil, "-t", filePath, "-l", targets.Name())
+	if err != nil {
+		return err
+	}
+	if err := expectResultsCount(got, len(want)); err != nil {
+		return err
+	}
+	joined := strings.Join(got, "\n")
+	for _, name := range want {
+		if !strings.Contains(joined, name) {
+			return fmt.Errorf("no result from server %q: %v", name, got)
+		}
+	}
+	return nil
+}
+
 // ensure that ip|host are handled without http|https scheme
 type httpGetWithoutScheme struct{}
 

internal/tests/integration/javascript_test.go

@@ -5,17 +5,20 @@ package integration_test
 
 import (
 	"database/sql"
+	"encoding/json"
 	"fmt"
 	"io"
 	"net"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/go-pg/pg/v10"
 	_ "github.com/go-sql-driver/mysql"
 	"github.com/ory/dockertest/v3"
 	dc "github.com/ory/dockertest/v3/docker"
 	"github.com/projectdiscovery/nuclei/v3/internal/tests/testutils"
+	"github.com/projectdiscovery/nuclei/v3/pkg/output"
 	osutils "github.com/projectdiscovery/utils/os"
 	"github.com/projectdiscovery/utils/reader"
 	"go.uber.org/multierr"
@@ -34,6 +37,7 @@ var jsTestcases = []integrationCase{
 	{Path: "protocols/javascript/redis-lua-script.yaml", TestCase: &javascriptRedisLuaScript{}, DisableOn: javascriptDockerDisabled, Serial: true},
 	{Path: "protocols/javascript/ssh-server-fingerprint.yaml", TestCase: &javascriptSSHServerFingerprint{}, DisableOn: javascriptDockerDisabled, Serial: true},
 	{Path: "protocols/javascript/net-multi-step.yaml", TestCase: &networkMultiStep{}},
+	{Path: "protocols/javascript/target-line-ip.yaml", TestCase: &javascriptTargetLineIP{}},
 	{Path: "protocols/javascript/net-https.yaml", TestCase: &javascriptNetHttps{}},
 	{Path: "protocols/javascript/grpc-health.yaml", TestCase: &javascriptGRPCHealth{}},
 	{Path: "protocols/javascript/grpc-denied.yaml", TestCase: &javascriptGRPCDenied{}},
@@ -467,6 +471,87 @@ func (j *networkMultiStep) Execute(filePath string) error {
 	return expectResultsCount(results, 1)
 }
 
+// target lines pin a hostname that does not resolve, so the javascript
+// connection reaches a server only through the pinned ip
+type javascriptTargetLineIP struct{}
+
+func (j *javascriptTargetLineIP) Execute(filePath string) error {
+	serve := func(addr, banner string) (net.Listener, error) {
+		listener, err := net.Listen("tcp", addr)
+		if err != nil {
+			return nil, err
+		}
+		go func() {
+			for {
+				conn, err := listener.Accept()
+				if err != nil {
+					return
+				}
+				_, _ = conn.Write([]byte(banner))
+				_ = conn.Close()
+			}
+		}()
+		return listener, nil
+	}
+
+	one, err := serve("127.0.0.1:0", "one")
+	if err != nil {
+		return err
+	}
+	defer func() { _ = one.Close() }()
+	_, port, err := net.SplitHostPort(one.Addr().String())
+	if err != nil {
+		return err
+	}
+
+	want := map[string]string{"127.0.0.1": "one"}
+	// the same host pinned to a second ip, where 127.0.0.2 is available
+	if two, err := serve(net.JoinHostPort("127.0.0.2", port), "two"); err == nil {
+		defer func() { _ = two.Close() }()
+		want["127.0.0.2"] = "two"
+	}
+
+	lines := make([]string, 0, len(want))
+	for ip := range want {
+		lines = append(lines, fmt.Sprintf(`{"target": "pinned.test:%s", "ip": %q}`, port, ip))
+	}
+	targets, err := os.CreateTemp("", "target-lines-*.txt")
+	if err != nil {
+		return err
+	}
+	defer func() { _ = os.Remove(targets.Name()) }()
+	if _, err := targets.WriteString(strings.Join(lines, "\n")); err != nil {
+		return err
+	}
+	_ = targets.Close()
+
+	if err := ensureSignedIntegrationTemplates(); err != nil {
+		return err
+	}
+	results, err := testutils.RunNucleiBareArgsAndGetResults(debug, getEnvValues(), "-t", filePath, "-l", targets.Name(), "-jsonl")
+	if err != nil {
+		return err
+	}
+
+	got := make(map[string]string)
+	for _, result := range results {
+		var event output.ResultEvent
+		if !strings.HasPrefix(result, "{") || json.Unmarshal([]byte(result), &event) != nil {
+			continue
+		}
+		got[event.IP] = strings.Join(event.ExtractedResults, ",")
+	}
+	if len(got) != len(want) {
+		return fmt.Errorf("got results for %d ips, want %d: %v", len(got), len(want), got)
+	}
+	for ip, banner := range want {
+		if got[ip] != banner {
+			return fmt.Errorf("ip %s answered %q, want %q", ip, got[ip], banner)
+		}
+	}
+	return nil
+}
+
 func runJavascriptDockerCase(filePath string, spec javascriptDockerSpec, expectedNumbers ...int) error {
 	if len(expectedNumbers) == 0 {
 		expectedNumbers = []int{1}

internal/tests/integration/network_test.go

@@ -6,6 +6,8 @@ package integration_test
 import (
 	"fmt"
 	"net"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
@@ -44,6 +46,38 @@ func TestNetwork(t *testing.T) {
 		}
 	})
 
+	t.Run("PinnedTargetLine", func(t *testing.T) {
+		server := testutils.NewTCPServer(nil, 0, func(conn net.Conn) {
+			defer func() { _ = conn.Close() }()
+
+			data, err := reader.ConnReadNWithTimeout(conn, 4, 5*time.Second)
+			if err == nil && string(data) == "PING" {
+				_, _ = conn.Write([]byte("PONG"))
+			}
+		})
+		defer server.Close()
+		_, port, err := net.SplitHostPort(server.URL)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		targets := filepath.Join(t.TempDir(), "targets.txt")
+		line := fmt.Sprintf(`{"target": "pinned.test:%s", "ip": "127.0.0.1"}`, port)
+		if err := os.WriteFile(targets, []byte(line), 0o600); err != nil {
+			t.Fatal(err)
+		}
+
+		// pinned.test does not resolve: the network request reaches the server
+		// only through the pinned ip
+		results, err := testutils.RunNucleiBareArgsAndGetResults(suite.debug, nil, "-t", "protocols/network/basic.yaml", "-l", targets)
+		if err != nil {
+			t.Fatalf("pinned network request failed: %v", err)
+		}
+		if err := expectResultsCount(results, 1); err != nil {
+			t.Fatal(err)
+		}
+	})
+
 	t.Run("Hex", func(t *testing.T) {
 		errState := &capturedError{}
 		server := testutils.NewTCPServer(nil, 0, func(conn net.Conn) {

internal/tests/integration/testdata/protocols/http/target-line-ip.yaml

@@ -0,0 +1,20 @@
+id: target-line-ip
+
+info:
+  name: Target Line IP
+  author: pdteam
+  severity: info
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+    matchers:
+      - type: word
+        words:
+          - "host=pinned.test:"
+    extractors:
+      - type: regex
+        group: 1
+        regex:
+          - "server=([a-z]+)"

internal/tests/integration/testdata/protocols/javascript/target-line-ip.yaml

@@ -0,0 +1,25 @@
+id: javascript-target-line-ip
+
+info:
+  name: JavaScript Target Line IP
+  author: pdteam
+  severity: info
+
+javascript:
+  - code: |
+      var m = require("nuclei/net");
+      var conn = m.Open("tcp", address);
+      conn.SetTimeout(timeout);
+      conn.RecvString(3)
+
+    args:
+      address: "{{Host}}:{{Port}}"
+      Host: "{{Host}}"
+      Port: 5431
+      timeout: 3
+
+    extractors:
+      - type: regex
+        part: response
+        regex:
+          - "[a-z]+"

pkg/core/executors.go

@@ -300,9 +300,11 @@ func (e *Engine) executeTemplateOnInput(ctx context.Context, template *templates
 	defer func() { finish(err == nil) }()
 	finished := e.templateExecutionStarted(template, value.Input)
 	defer func() { finished(ctx.Err()) }()
-	ctxArgs := contextargs.New(ctx)
+	// every protocol dials the target's host through its pinned ip, if any
+	pinnedCtx := contextargs.WithCustomIP(ctx, value)
+	ctxArgs := contextargs.New(pinnedCtx)
 	ctxArgs.MetaInput = value
-	scanCtx := scan.NewScanContext(ctx, ctxArgs)
+	scanCtx := scan.NewScanContext(pinnedCtx, ctxArgs)
 
 	switch template.Type() {
 	case types.WorkflowProtocol: