unclear detection logic while redirect

[savushkin-yauheni]

Hi team!

Today i found out a strange logic related to redirects.
If we enable redirects, does that mean a 302 response would be skipped for detection ?

I tested it, and it looks like it is.

Can I enable detection for each response of the redirect chain ?

Thanks!

e.x.:

id: test

info:
  name: test
  author: savik
  severity: info

requests:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: or
    redirects: true
    max-redirects: 3
    matchers:
      - type: word
        words:
          - "Location"
        part: header
        name: test

nuclei -t temp1.yaml -target https://demo.sophos.com/ -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36" --debug

[INF] No results found. Better luck next time!

then comment redirects: true:

nuclei -t temp1.yaml -target https://demo.sophos.com/ -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36" --debug

[2021-03-30 10:45:10] [test:test] [http] [info] https://demo.sophos.com/

[ehsandeep]

looks like you found a bug @savushkin-yauheni, thanks for reporting, tracking this issue here projectdiscovery/nuclei#652

[ehsandeep]

@savushkin-yauheni check this out projectdiscovery/nuclei#652 (comment)