search

projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.
https://github.com/projectdiscovery/nuclei
MIT License
8.78k stars 2.5k forks source link

Issue with nuclei templates ssl can't disable. this automaticly ssl true. pls help #9117

Closed lamrecognitions closed 4 months ago

lamrecognitions commented 5 months ago

Issue description:

how do I disable ssl:443 on nuclei ? I have looked for all the ways but when I run nuclei -t nuclei-templates/ -l list.txt the output results always appear and the target is only the domain that has ssl 443 I want to scan all the domains I have including ssl 80. please tire

lamrecognitions commented 5 months ago

Please help me, i need disable ssl on target domain:443 < after i run nuclei this automaticly add this 443 ssl.

lamrecognitions commented 5 months ago

Please Allow insecure ssl

lamrecognitions commented 5 months ago

I see this fixed on https://github.com/projectdiscovery/nuclei/issues/1136, but when i try again today. this problem still available.

ehsandeep commented 5 months ago

@lamrecognitions it's unclear to me what you are looking to disable?

If you are looking to disabe scanning ssl templates, you can add -ept ssl to your existing cli option.

pussycat0x commented 5 months ago

Hi @lamrecognitions

FYI : If the input is provided as 127.0.0.1:8034 or any other host, Nuclei will initially execute HTTPX. It will then determine whether to use HTTPS:// or HTTP:// based on the response received. This process is automated. The only requirement is to ensure that the input list does not contain URLs starting with HTTPS://; if it does, HTTPX won't be executed on those URLs.

Else Try Below Method with naabu Example: subfinder -d hackerone.com | naabu | nuclei

lamrecognitions commented 5 months ago

Hi! @ehsandeep I have tried the -ept ssl command and the result scanner still uses 443.

[INF] Skipped baaa.subdomain.server.com:443 from target list as found unresponsive 34

please help, how to Allow insecure ssl

lamrecognitions commented 5 months ago

Hi! @ehsandeep

I've been using nuclei for more than a few years, and this is the first time I've tried it again. there have been many changes to nuclei, especially the folder layout, and this time when I scan a list like nuclei -l urls.txt -t nuclei-templates/ and the results on the cli show that nuclei automatically scans using ssl target:443,

as I said before, because not all website-targets use ssl-secure / 443 therefore I would like to ask for your help, how as before. that nuclei uses scanner port 80 not only 443.

alias (not using ssl port) only using domain only.

image

I've been using nuclei for more than a few years, and this is the first time I've tried it again. there have been many changes to nuclei, especially the folder layout, and this time when I scan a list like nuclei -l urls.txt -t nuclei-templates/ and the results on the cli show that nuclei automatically scans using ssl target:443,

as I said before, because not all website-targets use ssl-secure / 443 therefore I would like to ask for your help, how as before. that nuclei uses scanner port 80 not only 443.

alias (not using ssl port) only using domain only.

I used to use nuclei when displayed on the cli, namely nuclei automatic scan with example 

[INF] Skipped datalab.amsterdam.nl from target list as found unresponsive 34 times

only the domain name is scanned but does not use 443

but today nuclei instead automatically uses port 443. please how to not use the port.

fail-open commented 5 months ago

disable httpx from running. -nh -no-httpx

pussycat0x commented 4 months ago

Hello @lamrecognitions , I trust you've found the solution you were seeking. I'll be marking this issue as resolved for now. Should you have any further questions or concerns, please don't hesitate to reopen it.