Add nuclei presets

[liquidsec]

todo:

• Update docs whenever presets are finalized

[TheTechromancer]

Do we need to enable the spider in the nuclei presets? Personally I think it makes sense to keep them separate, since if you want to enable both it's as easy as -p nuclei spider. If we want to have multiple spider presets like spider-light, spider-max, etc., that might make sense though.

[liquidsec]

my thinking here was just to explicitly set them, one way or another, because of how dramatic the difference in the scan will be. I figured including the 0 settings, even though they are default, would help people understand the differences when they examine the yml files.

How would you feel about doing spider-light/max whatever and including them?

if so, would it make sense to have spider-none or should we just lean on the defaults with that?

[TheTechromancer]

that would make more sense but I still think that in order to spider things, the user should have to explicitly enable it. including it in presets makes it too easy to accidentally enable.

Another problem with explicitly setting them in the preset, is that depending on how you order your presets, you'll get different results. I.e. -p spider nuclei-budget won't spider, but -p nuclei-budget spider will.

[liquidsec]

Another problem with explicitly setting them in the preset, is that depending on how you order your presets, you'll get different results. I.e. -p spider nuclei-budget won't spider, but -p nuclei-budget spider will.

To be honest, i don't like this - or at least not unless this behavior is explained pretty well at runtime.

I know we talked about preset conflict resolution and didn't go that route, and i know all of the pitfalls associated with that. At this point a message when you have multiple presets explaining this behavior is probably ok.

I am fine with making the user define them separately, however, alot of the other settings don't make any sense unless spider is turned on.

Later when we deal with lightfuzz presets, spidering is essentially an absolute requirement, and thats why they are hardcoded there.

Just imagining my own use of these, i'd rather not remember to have to turn on an additional preset just to get the preset to function as intended.

[liquidsec]

Also given the order matters for presets, if we did go the route of having spider-light spider-heavy or whatever, it would actually make sense in that situation to have spider-none, to nullify spidering which is enabled in a different preset

[liquidsec]

@TheTechromancer 87115cf

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 93%. Comparing base (b7d12e9) to head (b3a0441).
Report is 42 commits behind head on dev.

Additional details and impacted files

@@          Coverage Diff          @@
##             dev   #2188   +/-   ##
=====================================
+ Coverage     93%     93%   +1%     
=====================================
  Files        376     378    +2     
  Lines      29224   29282   +58     
=====================================
+ Hits       27004   27067   +63     
+ Misses      2220    2215    -5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.