First custom template - failed to load

[HachimanSec]

Hey,
this seems like a really dumb question, but I can't get my first custom template to run.

I tried to follow the vid: https://www.youtube.com/watch?v=nFXygQdtjyw and the guide at https://docs.projectdiscovery.io/templates/introduction

There is no code in it, so as far as I understand signing is not mandatory.

nuclei -t /home/user/nuclei-templates-custom/mta-sts.yaml -l ./domains.txt

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.2.4

                projectdiscovery.io

[INF] Current nuclei version: v3.2.4 (outdated)
[INF] Current nuclei-templates version: v9.8.6 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] Targets loaded for current scan: 14
[INF] No results found. Better luck next time!
[FTL] Could not run nuclei: no templates provided for scan

The template is quite simple and tries to detect mta-sts:

id: mta-sts-detection

info:
  name: MTA-STS Detection
  author: tom
  severity: info
  description: Detects the presence of MTA-STS configuration
  tags: email,security

 dns:
  - name: "{{FQDN}}"
    type: TXT
    matchers:
      - type: word
        words:
          - "v=spf1"

    extractors:
      - type: regex
        regex:
          - "v=mta-sts(.+)"

http:
  - method: GET
    path:
      - "/.well-known/mta-sts.txt"
    hosts:
      - "https://mta-sts.{{Hostname}}"
    headers:
      User-Agent: nuclei
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
          -       - type: word
        words:
          - "version: STSv1"
          - "mode:"
          - "max_age:"
          - "mx:"```

[rxerium]

Hey @HachimanSec, give this a try:

id: mta-sts-detection

info:
  name: MTA-STS Detection
  author: tom
  severity: info
  description: Detects the presence of MTA-STS configuration
  tags: email,security

dns:
  - name: "{{FQDN}}"
    type: TXT

    matchers:
      - type: word
        words:
          - "v=spf1"

    extractors:
      - type: regex
        regex:
          - "v=mta-sts(.+)"

http:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/mta-sts.txt"
      - "https://mta-sts.{{Hostname}}"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "version: STSv1"
          - "mode:"
          - "max_age:"
          - "mx:"

Let me know if this works for you.

[HachimanSec]

Thx @rxerium this did the trick. Do you know why there was this [FTL] Could not run nuclei: no templates provided for scan
error?
Now I can play aroudn with it and test it. Thanks again!

[HachimanSec]

Maybe you have a hint for me @rxerium, is there any documentation on how to beautify the extractor output?
Right now I get something like this:
[mta-sts-detection] [dns] [info] mta-sts.proton.me ["mta-sts.proton.me.\t1200\tIN\tCNAME\tmail-api.proton.me.","mta-sts.proton.me.\tIN\t A"]
But I would want to repalce the \t with some more readabe format.

[rxerium]

Glad you got everything working!!

Thx @rxerium this did the trick. Do you know why there was this [FTL] Could not run nuclei: no templates provided for scan error? Now I can play aroudn with it and test it. Thanks again!

It was the format / syntax of the template. Next time if you run nuclei -t template -validate it'll tell you where the errors are.

Maybe you have a hint for me @rxerium, is there any documentation on how to beautify the extractor output? Right now I get something like this: [mta-sts-detection] [dns] [info] mta-sts.proton.me ["mta-sts.proton.me.\t1200\tIN\tCNAME\tmail-api.proton.me.","mta-sts.proton.me.\tIN\t A"] But I would want to repalce the \t with some more readabe format.

AFAIK you'll need to edit the extractors in the template to output specifically what you'd like. 😊

[HachimanSec]

Thank you @rxerium. I will have a look at it play around. 👍