Nuclei Delete Anything After # Mark

[0xAwali]

Nuclei Delete Anything After # e.g. Template Is

id: keenetic-web-login
info:
  name: Keenetic Web Login
  author: dhiyaneshDK
  severity: info
  reference: https://www.exploit-db.com/ghdb/6817
  tags: panel,keenetic

requests:
  - raw:
      - |
        GET /login#goto=%2Fdashboard HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '<title ng-bind="$root.title">Keenetic Web</title>'
      - type: status
        status:
          - 200

Nuclei Will Send Request

Nuclei version

2.4.0

[geeknik]

If you add unsafe: true to the template does the behavior change?

[0xAwali]

No , I'm Just Use Its Now With unsafe: true AND Work Correctly

[ehsandeep]

@0xAwali you only need to access /login to get the expected content/match, anything after# in URL is used on the client-side.