Skip to content

Commit

Permalink
Fixed nuclei ignore issues + made random agent default
Browse files Browse the repository at this point in the history
  • Loading branch information
Ice3man543 committed Mar 31, 2021
1 parent 12b03f3 commit 718e450
Show file tree
Hide file tree
Showing 6 changed files with 10 additions and 35 deletions.
2 changes: 1 addition & 1 deletion v2/cmd/nuclei/main.go
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ based on templates offering massive extensibility and ease of use.`)
set.BoolVarP(&options.NoColor, "no-color", "nc", false, "Disable colors in output")
set.IntVar(&options.Timeout, "timeout", 5, "Time to wait in seconds before timeout")
set.IntVar(&options.Retries, "retries", 1, "Number of times to retry a failed request")
set.BoolVarP(&options.RandomAgent, "random-agent", "ra", false, "Use randomly selected HTTP User-Agent header value")
set.BoolVarP(&options.RandomAgent, "random-agent", "ra", true, "Use randomly selected HTTP User-Agent header value")
set.StringSliceVarP(&options.CustomHeaders, "header", "H", []string{}, "Custom Header.")
set.BoolVar(&options.Debug, "debug", false, "Debugging request and responses")
set.BoolVar(&options.DebugRequests, "debug-req", false, "Debugging request")
Expand Down
7 changes: 1 addition & 6 deletions v2/internal/runner/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -114,17 +114,12 @@ func (r *Runner) getIgnoreFilePath() string {
_ = os.MkdirAll(configDir, os.ModePerm)

defIgnoreFilePath = path.Join(configDir, nucleiIgnoreFile)
return defIgnoreFilePath
}

cwd, err := os.Getwd()
if err != nil {
return defIgnoreFilePath
}
cwdIgnoreFilePath := path.Join(cwd, nucleiIgnoreFile)

cwdIfpInfo, err := os.Stat(cwdIgnoreFilePath)
if os.IsNotExist(err) || cwdIfpInfo.IsDir() {
return defIgnoreFilePath
}
return cwdIgnoreFilePath
}
1 change: 1 addition & 0 deletions v2/internal/runner/runner.go
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ func New(options *types.Options) (*Runner, error) {
runner.readNucleiIgnoreFile()
}
runner.catalog = catalog.New(runner.options.TemplatesDirectory)
runner.catalog.AppendIgnore(runner.templatesConfig.IgnorePaths)

var reportingOptions *reporting.Options
if options.ReportingConfig != "" {
Expand Down
3 changes: 2 additions & 1 deletion v2/internal/runner/update.go
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ func (r *Runner) updateTemplates() error {
configDir := path.Join(home, "/.config", "/nuclei")
_ = os.MkdirAll(configDir, os.ModePerm)

templatesConfigFile := path.Join(home, nucleiConfigFilename)
templatesConfigFile := path.Join(configDir, nucleiConfigFilename)
if _, statErr := os.Stat(templatesConfigFile); !os.IsNotExist(statErr) {
config, readErr := readConfiguration()
if err != nil {
Expand All @@ -65,6 +65,7 @@ func (r *Runner) updateTemplates() error {
}
r.templatesConfig = currentConfig
}

// Check if last checked for nuclei-ignore is more than 1 hours.
// and if true, run the check.
if r.templatesConfig == nil || time.Since(r.templatesConfig.LastCheckedIgnore) > 1*time.Hour || r.options.UpdateTemplates {
Expand Down
6 changes: 5 additions & 1 deletion v2/pkg/catalog/catalogue.go
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,10 @@ type Catalog struct {
// New creates a new Catalog structure using provided input items
func New(directory string) *Catalog {
catalog := &Catalog{templatesDirectory: directory}
catalog.readNucleiIgnoreFile()
return catalog
}

// AppendIgnore appends to the catalog store ignore list.
func (c *Catalog) AppendIgnore(list []string) {
c.ignoreFiles = append(c.ignoreFiles, list...)
}
26 changes: 0 additions & 26 deletions v2/pkg/catalog/ignore.go
Original file line number Diff line number Diff line change
@@ -1,37 +1,11 @@
package catalog

import (
"bufio"
"os"
"path"
"strings"

"github.com/projectdiscovery/gologger"
)

const nucleiIgnoreFile = ".nuclei-ignore"

// readNucleiIgnoreFile reads the nuclei ignore file marking it in map
func (c *Catalog) readNucleiIgnoreFile() {
file, err := os.Open(path.Join(c.templatesDirectory, nucleiIgnoreFile))
if err != nil {
return
}
defer file.Close()

scanner := bufio.NewScanner(file)
for scanner.Scan() {
text := scanner.Text()
if text == "" {
continue
}
if strings.HasPrefix(text, "#") {
continue
}
c.ignoreFiles = append(c.ignoreFiles, text)
}
}

// checkIfInNucleiIgnore checks if a path falls under nuclei-ignore rules.
func (c *Catalog) checkIfInNucleiIgnore(item string) bool {
if c.templatesDirectory == "" {
Expand Down

5 comments on commit 718e450

@codingo
Copy link

@codingo codingo commented on 718e450 Apr 2, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a compelling reason to have user agent randomization as the default? This seems like a very bad decision, and I'm hoping I'm missing something...

@amalmurali47
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with @codingo. This seems like a very bad decision that could have a lot of bad after-effects.

@ehsandeep
Copy link
Member

@ehsandeep ehsandeep commented on 718e450 Apr 2, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@codingo @amalmurali47 ^

that could have a lot of bad after-effects.

I'm not sure about after-effects but we received multiple feedbacks where nuclei getting blocked resulting in no results / false-negative for the valid security issue, the default UA making the tool ineffective so the change, hope you get the idea now.

@amalmurali47
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ehsandeep The tool already offers an option to randomize the user agent. The users that want to randomize user agents can simply use that option, right? The problems caused by making it the default setting far outweighs the benefits, IMHO.

@ehsandeep
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@amalmurali47 answered here #655

Please sign in to comment.