Course 3 - Mastering Nuclei for Bug Bounty | Episode 4: Headers, Body, Raw Requests, and Response Matching | CyberCode Academy

In this lesson, you’ll learn about:

Custom headers in templates: define headers: as key–value pairs (e.g., User-Agent, X-Forwarded-Host, or custom headers like X-Test: hello world) to tag or alter requests.
Request bodies: use the body: block to send POST/PUT payloads (e.g., search=apple) required by many vulnerable endpoints.
Cookie reuse / session handling: enable cookie reuse: true to persist cookies across requests when the target requires session continuity.
Raw requests: use the raw: block to supply an exact HTTP request (as copied from Burp) supporting methods like GET, POST, PUT, DELETE for full-fidelity testing.
Unsafe raw requests: set unsafe: true to allow malformed or protocol-abusing requests (useful for finding CRLF injection, HTTP request smuggling, or other edge-case bugs) — use with extreme caution and only in-scope.
Matchers / response logic: create matchers that check status codes (e.g., status: 200), response body words (e.g., match apple), or custom response headers (e.g., new-header) to confirm findings.
Combining matchers & extractors: pair precise matchers with extractors to capture version strings or identifiers from responses for clearer output.
Practical tips: test templates locally with -debug and via a proxy (e.g., Burp) to inspect exact requests/responses; validate YAML with a linter before wide runs; respect scope and avoid unsafe:true on production targets.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy

Course 3 - Mastering Nuclei for Bug Bounty | Episode 4: Headers, Body, Raw Requests, and Response Matching