Adding SNI override via request annotations

[Mzack9999]

Proposed changes

This PR implements SNI override via request annotations. The annotations has a syntax like @tls-sni:value. if value is equal to request.host then the value of the Host header is used as SNI name.

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Correlated PRs

• Adding custom SNI name fastdialer#35
• Adding description for SNI annotation nuclei-docs#37

Example

$ cat t.yaml

id: example

info:
  name: example
  author: pdteam
  severity: info

requests:
  - raw:
      # request.host => copy the value of Host header
      # any other value is copied literally
      - |
        @tls-sni:request.host
        GET / HTTP/1.1
        Host: {{interactsh-url}}
        Origin: {{BaseURL}}

    matchers:
      - type: word
        part: interactsh_protocol  # Confirms the DNS Interaction
        words:
          - "dns"

$ echo https://192.168.1.1 | go run . -t t.yaml

Improvements

• SNI for SSL Templates
• SNI for Network templates

[Ice3man543]

Do we also intend to support http variables in SNI field @ehsandeep @Mzack9999? As I see in the issue the user also asked for global vars in SNI field which is not supported here.

[Mzack9999]

@Ice3man543 I think it would make things quite complex. The specific case used the exact value of the Host header, which can be done using the particular value request.host, which will pull the value at runtime after the expression evaluation.

[0xAwali]

Hi @Mzack9999 I checked this one but it's not work when using unsafe: true because nuclei will send @tls-sni:request.host in the request otherwise it work correctly so maybe if you add -sni option too , that will solve unsafe: true problem , plus if anyone found target use specific SNI , he will can run nuclei templates e.g.
echo "https://target" | nuclei -sni "specific-SNI" -H "Host: specific-SNI" -t /nuclei-templates

[ehsandeep]

• merge conflict
• doesn't work with unsafe: true; this applies to CLI flag support as well. moved to Custom SNI support for other protocols #1984
• CLI option should override request annotation

[ehsandeep]

Hi @Mzack9999 I checked this one but it's not work when using unsafe: true because nuclei will send @tls-sni:request.host in the request otherwise it work correctly so maybe if you add -sni option too , that will solve unsafe: true problem , plus if anyone found target use specific SNI , he will can run nuclei templates e.g. echo "https://target" | nuclei -sni "specific-SNI" -H "Host: specific-SNI" -t /nuclei-templates

Thanks for pointing this out, including unsafe: true there are other protocols that needs to be supported and getting tracked here - #1984