nuclei-action does not support flags: correctly

[glassrye]

The flags: are not properly used. Without these flags, especially rate limiting, it is very easy to overwhelm a target host.

        uses: projectdiscovery/nuclei-action@main
        with:
          target: https://qa.redacted.com
          flags: "-rate-limit 10"

  /usr/bin/unzip -o -q /home/runner/work/_temp/41c11ed2-a0e8-483e-9efb-37583970f5e5
  Nuclei 2.7.3 was successfully installed to /home/runner/work/_temp/9a5d95b9-d906-4758-b26e-c31067dbc579.
/home/runner/work/_temp/9a5d95b9-d906-4758-b26e-c31067dbc579/nuclei -target=https://qa.deepdyve.com/ -se=nuclei.sarif -rate-limit 10 -o=nuclei.log
flag provided but not defined: -rate-limit 10
Nuclei is a fast, template based vulnerability scanner focusing
on extensive configurability, massive extensibility and ease of use.
Usage:
  /home/runner/work/_temp/9a5d95b9-d906-4758-b26e-c31067dbc579/nuclei [flags]
Flags:
TARGET:
   -u, -target string[]  target URLs/hosts to scan
   -l, -list string      path to file containing a list of target URLs/hosts to scan (one per line)
   -resume string        Resume scan using resume.cfg (clustering will be disabled)
TEMPLATES:
   -nt, -new-templates          run only new templates added in latest nuclei-templates release
   -as, -automatic-scan         automatic web scan using wappalyzer technology detection to tags mapping
   -t, -templates string[]      list of template or template directory to run (comma-separated, file)
   -tu, -template-url string[]  list of template urls to run (comma-separated, file)
   -w, -workflows string[]      list of workflow or workflow directory to run (comma-separated, file)
   -wu, -workflow-url string[]  list of workflow urls to run (comma-separated, file)
   -validate                    validate the passed templates to nuclei
   -tl                          list all available templates
FILTERING:
   -a, -author string[]              templates to run based on authors (comma-separated, file)
   -tags string[]                    templates to run based on tags (comma-separated, file)
   -etags, -exclude-tags string[]    templates to exclude based on tags (comma-separated, file)
   -itags, -include-tags string[]    tags to be executed even if they are excluded either by default or configuration
   -id, -template-id string[]        templates to run based on template ids (comma-separated, file)
   -eid, -exclude-id string[]        templates to exclude based on template ids (comma-separated, file)
   -it, -include-templates string[]  templates to be executed even if they are excluded either by default or configuration
   -et, -exclude-templates string[]  template or template directory to exclude (comma-separated, file)
   -s, -severity value[]             templates to run based on severity. Possible values: info, low, medium, high, critical, unknown
   -es, -exclude-severity value[]    templates to exclude based on severity. Possible values: info, low, medium, high, critical, unknown
   -pt, -type value[]                templates to run based on protocol type. Possible values: dns, file, http, headless, network, workflow, ssl, websocket, whois
   -ept, -exclude-type value[]       templates to exclude based on protocol type. Possible values: dns, file, http, headless, network, workflow, ssl, websocket, whois
OUTPUT:
   -o, -output string            output file to write found issues/vulnerabilities
   -sresp, -store-resp           store all request/response passed through nuclei to output directory
   -srd, -store-resp-dir string  store all request/response passed through nuclei to custom directory (default "output")
   -silent                       display findings only
   -nc, -no-color                disable output content coloring (ANSI escape codes)
   -json                         write output in JSONL(ines) format
   -irr, -include-rr             include request/response pairs in the JSONL output (for findings only)
   -nm, -no-meta                 disable printing result metadata in cli output
   -nts, -no-timestamp           disable printing timestamp in cli output
   -rdb, -report-db string       nuclei reporting database (always use this to persist report data)
   -ms, -matcher-status          display match failure status
   -me, -markdown-export string  directory to export results in markdown format
   -se, -sarif-export string     file to export results in SARIF format
CONFIGURATIONS:
   -config string              path to the nuclei configuration file
   -fr, -follow-redirects      enable following redirects for http templates
   -mr, -max-redirects int     max number of redirects to follow for http templates (default 10)
   -dr, -disable-redirects     disable redirects for http templates
   -rc, -report-config string  nuclei reporting module configuration file
   -H, -header string[]        custom header/cookie to include in all http request in header:value format (cli, file)
   -V, -var value              custom vars in key=value format
   -r, -resolvers string       file containing resolver list for nuclei
   -sr, -system-resolvers      use system DNS resolving as error fallback
   -passive                    enable passive HTTP response processing mode
   -ev, -env-vars              enable environment variables to be used in template
   -cc, -client-cert string    client certificate file (PEM-encoded) used for authenticating against scanned hosts
   -ck, -client-key string     client key file (PEM-encoded) used for authenticating against scanned hosts
   -ca, -client-ca string      client certificate authority file (PEM-encoded) used for authenticating against scanned hosts
   -sml, -show-match-line      show match lines for file templates, works with extractors only
   -ztls                       use ztls library with autofallback to standard one for tls13
   -sni string                 tls sni hostname to use (default: input domain name)
INTERACTSH:
   -iserver, -interactsh-server string  interactsh server url for self-hosted instance (default: oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me)
   -itoken, -interactsh-token string    authentication token for self-hosted interactsh server
   -interactions-cache-size int         number of requests to keep in the interactions cache (default 5000)
   -interactions-eviction int           number of seconds to wait before evicting requests from cache (default 60)
   -interactions-poll-duration int      number of seconds to wait before each interaction poll request (default 5)
   -interactions-cooldown-period int    extra time for interaction polling before exiting (default 5)
   -ni, -no-interactsh                  disable interactsh server for OAST testing, exclude OAST based templates
RATE-LIMIT:
   -rl, -rate-limit int            maximum number of requests to send per second (default 150)
   -rlm, -rate-limit-minute int    maximum number of requests to send per minute
   -bs, -bulk-size int             maximum number of hosts to be analyzed in parallel per template (default 25)
   -c, -concurrency int            maximum number of templates to be executed in parallel (default 25)
   -hbs, -headless-bulk-size int   maximum number of headless hosts to be analyzed in parallel per template (default 10)
   -hc, -headless-concurrency int  maximum number of headless templates to be executed in parallel (default 10)
OPTIMIZATIONS:
   -timeout int                time to wait in seconds before timeout (default 5)
   -retries int                number of times to retry a failed request (default 1)
   -ldp, -leave-default-ports  leave default HTTP/HTTPS ports (eg. host:80,host:443
   -mhe, -max-host-error int   max errors for a host before skipping from scan (default 30)
   -project                    use a project folder to avoid sending same request multiple times
   -project-path string        set a specific project path (default "/tmp")
   -spm, -stop-at-first-path   stop processing HTTP requests after the first match (may break template/workflow logic)
   -stream                     stream mode - start elaborating without sorting the input
HEADLESS:
   -headless            enable templates that require headless browser support (root user on linux will disable sandbox)
   -page-timeout int    seconds to wait for each page in headless mode (default 20)
   -sb, -show-browser   show the browser on the screen when running templates with headless mode
   -sc, -system-chrome  Use local installed chrome browser instead of nuclei installed
DEBUG:
   -debug                    show all requests and responses
   -dreq, -debug-req         show all sent requests
   -dresp, -debug-resp       show all received responses
   -p, -proxy string[]       list of http/socks5 proxy to use (comma separated or file input)
   -pi, -proxy-internal      proxy all internal requests
   -tlog, -trace-log string  file to write sent requests trace log
   -elog, -error-log string  file to write sent requests error log
   -version                  show nuclei version
   -hm, -hang-monitor        enable nuclei hang monitoring
   -v, -verbose              show verbose output
   -vv                       display templates loaded for scan
   -ep, -enable-pprof        enable pprof debugging server
   -tv, -templates-version   shows the version of the installed nuclei-templates
   -health-check             run diagnostic check up
UPDATE:
   -update                        update nuclei engine to the latest released version
   -ut, -update-templates         update nuclei-templates to latest released version
   -ud, -update-directory string  overwrite the default directory to install nuclei-templates
   -duc, -disable-update-check    disable automatic nuclei/templates update check
STATISTICS:
   -stats                    display statistics about the running scan
   -sj, -stats-json          write statistics data to an output file in JSONL(ines) format
   -si, -stats-interval int  number of seconds to wait between showing a statistics update (default 5)
   -m, -metrics              expose nuclei metrics on a port
   -mp, -metrics-port int    port to expose nuclei metrics on (default 9092)
/home/runner/work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1598
                error = new Error(`The process '${this.toolPath}' failed with exit code ${this.processExitCode}`);
                        ^
Error: The process '/home/runner/work/_temp/9a5d95b9-d906-4758-b26e-c31067dbc579/nuclei' failed with exit code 2
    at ExecState._setResult (/home/runner/work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1598:25)
    at ExecState.CheckComplete (/home/runner/work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1581:18)
    at ChildProcess.<anonymous> (/home/runner/work/_actions/projectdiscovery/nuclei-action/main/dist/index.js:1475:27)
    at ChildProcess.emit (node:events:390:28)
    at maybeClose (node:internal/child_process:1064:16)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5)```

[aminvakil]

Just faced the same issue: flag provided but not defined: -exclude-id http-missing-security-headers -system-resolvers

[ehsandeep]

@fguisso any idea what might be causing this issue? as everything looks fine in terms of flag input.

[fguisso]

Okay, I finded the problem, the new github actions toolkit needs declared and separate params, I'll find a better way to fix it without changing the past behavior.

For now, @glassrye you can use rate-limit in this way:

flag: -rate-limit=10

@aminvakil and similar cases, you will need to wait for my fix or use just one flag:

flag: -exclude-id=http-missing-security-headers

[aminvakil]

@fguisso Thanks, I will wait for your fix and revert my commit removing the flag then.

[fguisso]

@aminvakil I never tried that, but probably you can set the version in the workflow like this and use the last version that flags work:

name: Nuclei - DAST Scan

on:
    schedule:
      - cron: '0 0 * * *'
    workflow_dispatch:

jobs:
  nuclei-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-go@v2
        with:
          go-version: 1.17

      - name: Nuclei - DAST Scan
        uses: projectdiscovery/nuclei-action@v1.0.6
        with:
          target: https://example.com

      - name: GitHub Workflow artifacts
        uses: actions/upload-artifact@v2
        with:
          name: nuclei.log
          path: nuclei.log

      - name: GitHub Security Dashboard Alerts update
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: nuclei.sarif

[aminvakil]

@fguisso Yes, thanks, I'm fine with waiting on your fix though.

[fguisso]

hey @glassrye @aminvakil can you test this change please: fguisso/nuclei-action#80fe93

You must substitute projectdiscovery/nuclei-action@main with fguisso/nuclei-action@fix-flags in your workflow.

[aminvakil]

@fguisso

Here is my step:

      - name: Nuclei Scan
        uses: fguisso/nuclei-action@fix-flags
        with:
          urls: output/active_urls.txt
          output: output/nuclei_output.txt
          flags: "-exclude-id http-missing-security-headers"

It failed with this error:

Run fguisso/nuclei-action@fix-flags
  with:
    urls: output/active_urls.txt
    output: output/nuclei_output.txt
    flags: -exclude-id http-missing-security-headers
    json: false
    include-rr: false
    github-report: false
  env:
    GOROOT: /opt/hostedtoolcache/go/1.17.12/x64
Download and install Nuclei 2.7.4
  Download version 2.7.4 from https://github.com/projectdiscovery/nuclei/releases/download/v2.7.4/nuclei_2.7.4_linux_amd64.zip.
  /usr/bin/unzip -o -q /home/runner/work/_temp/ae83c5ad-0566-4348-9727-7a1749d5cebe
  Nuclei 2.7.4 was successfully installed to /home/runner/work/_temp/096635b8-3602-4807-8ff2-fe33260fe4ed.
/home/runner/work/_temp/096635b8-3602-4807-8ff2-fe33260fe4ed/nuclei -list=output/active_urls.txt -se=nuclei.sarif -o=output/nuclei_output.txt -exclude-id http-missing-security-headers
flag provided but not defined: -exclude-id http-missing-security-headers
Nuclei is a fast, template based vulnerability scanner focusing
on extensive configurability, massive extensibility and ease of use.
Usage:
  /home/runner/work/_temp/096635b8-3602-4807-8ff2-fe33260fe4ed/nuclei [flags]
Flags:
TARGET:
   -u, -target string[]  target URLs/hosts to scan
   -l, -list string      path to file containing a list of target URLs/hosts to scan (one per line)
   -resume string        Resume 

...

STATISTICS:
   -stats                    display statistics about the running scan
   -sj, -stats-json          write statistics data to an output file in JSONL(ines) format
   -si, -stats-interval int  number of seconds to wait between showing a statistics update (default 5)
   -m, -metrics              expose nuclei metrics on a port
   -mp, -metrics-port int    port to expose nuclei metrics on (default 9092)
/home/runner/work/_actions/fguisso/nuclei-action/fix-flags/dist/index.js:1598
                error = new Error(`The process '${this.toolPath}' failed with exit code ${this.processExitCode}`);
                        ^
Error: The process '/home/runner/work/_temp/096635b8-3602-4807-8ff2-fe33260fe4ed/nuclei' failed with exit code 2
    at ExecState._setResult (/home/runner/work/_actions/fguisso/nuclei-action/fix-flags/dist/index.js:1598:25)
    at ExecState.CheckComplete (/home/runner/work/_actions/fguisso/nuclei-action/fix-flags/dist/index.js:1581:18)
    at ChildProcess.<anonymous> (/home/runner/work/_actions/fguisso/nuclei-action/fix-flags/dist/index.js:1475:27)
    at ChildProcess.emit (node:events:390:28)
    at maybeClose (node:internal/child_process:1064:16)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:301:5)

[fguisso]

@aminvakil updated, try again please, and if you get more errors reach me in pd discord server, nickname hackaponey with the same avatar, please.

[aminvakil]

@fguisso Sorry for late response.

It worked, thank you!

Nuclei Scan step is running for now and I'm waiting for it to be finished and also report back if it actually respected the flags or not.

But it has been started.

[aminvakil]

It finished correctly! Thank you very much for fixing this!

[fguisso]

@aminvakil @glassrye and anyone else, can you test more cases, please? Now the update resides in the dev branch. You must substitute projectdiscovery/nuclei-action@main with projectdiscovery/nuclei-action@dev in your workflow.