Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[issue] Output results with URLs containing percent character shown with double-percent characters #220

Closed
manuelbua opened this issue Aug 7, 2020 · 2 comments · Fixed by #348
Assignees
Labels
Priority: High After critical issues are fixed, these should be dealt with before any further issues. Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.
Milestone

Comments

@manuelbua
Copy link
Contributor

Describe the bug
When results are written to stdout/file and URLs contain % character, a double %% is shown instead. For example running the rce-via-java-deserialization template that defines requests such as the following:

...
    path:
      - "{{BaseURL}}/josso/%5C../invoker/EJBInvokerServlet/"
      - "{{BaseURL}}/josso/%5C../invoker/JMXInvokerServlet/"
...

Running them against an host that always satisfy the matcher there:

echo 'http://localhost:9999' | nuclei -t ./vulnerabilities/rce-via-java-deserialization.yaml

..
[rce-via-java-deserialization] [http] http://localhost:9999/josso/%%5C../invoker/EJBInvokerServlet/
[rce-via-java-deserialization] [http] http://localhost:9999/josso/%%5C../invoker/JMXInvokerServlet/
..

Note the %%5C: those URLs are therefore invalid and i've tracked it down to this line performing the encoding: this may be as simple as using URL directly, but i suspect there was a reason for this, do you remember what it was @Ice3man543?

Nuclei version
Latest master

@ehsandeep ehsandeep added Priority: Low This issue can probably be picked up by anyone looking to contribute to the project, as an entry fix Status: Accepted Type: Optimization Increasing the performance/optimization. Not an issue, just something to consider. labels Aug 7, 2020
@Ice3man543
Copy link
Member

@manuelbua yeah you're right. This was added to allow us to print lines containing % character without facing %MISSING errors but seems like recent changes broke this functionality. I'll take a look on this issue and fix this ASAP! Nice catcha and awesome work on PR #219 .

@Ice3man543 Ice3man543 added Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors. and removed Type: Optimization Increasing the performance/optimization. Not an issue, just something to consider. labels Aug 7, 2020
@manuelbua
Copy link
Contributor Author

Cool, that's explain why this was done, thanks!

@ehsandeep ehsandeep added Priority: High After critical issues are fixed, these should be dealt with before any further issues. and removed Priority: Low This issue can probably be picked up by anyone looking to contribute to the project, as an entry fix labels Oct 9, 2020
@ehsandeep ehsandeep added this to the 2.1.2 milestone Oct 9, 2020
@Mzack9999 Mzack9999 self-assigned this Oct 11, 2020
@Mzack9999 Mzack9999 linked a pull request Oct 11, 2020 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Priority: High After critical issues are fixed, these should be dealt with before any further issues. Type: Bug Inconsistencies or issues which will cause an issue or problem for users or implementors.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants