search

projectdiscovery / nuclei

Fast and customizable vulnerability scanner based on simple YAML based DSL.
https://docs.projectdiscovery.io/tools/nuclei
MIT License
20.11k stars 2.46k forks source link

some templates miss when use nuclei with -tags option #3937

Closed CHYbeta closed 1 year ago

CHYbeta commented 1 year ago

Nuclei version:

2.9.8

Current Behavior:

some templates miss when use nuclei with -tags option

cat /root/nuclei-templates/http/vulnerabilities/wordpress/wp-xmlrpc-brute-force.yaml |grep php

name: Wordpress XMLRPC.php username and password Bruteforcer
  description: This template bruteforces username and passwords through xmlrpc.php being available.
  tags: wordpress,php,xmlrpc,fuzz
        POST /xmlrpc.php HTTP/1.1

however , it will miess when nuclei with tags option

nuclei -t /root/nuclei-templates/http/vulnerabilities/wordpress/  -tags php -tl

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.8

                projectdiscovery.io

Listing available v9.5.7 nuclei templates for /root/nuclei-templates

image

another example

 cat /root/nuclei-templates/http/exposures/backups/php-backup-files.yaml |grep php

id: php-backup-files
  tags: exposure,backup,php,disclosure,fuzz

image

also no result

Expected Behavior:

should list template with its tags

Anything else:

CHYbeta commented 1 year ago

image

list tpl in /root/nuclei-templates/http/vulnerabilities/wordpress/ with tgs xmlrpc

 nuclei -t /root/nuclei-templates/http/vulnerabilities/wordpress/  -tags xmlrpc -tl

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.8

                projectdiscovery.io

Listing available v9.5.7 nuclei templates for /root/nuclei-templates
http/vulnerabilities/wordpress/wp-xmlrpc-pingback-detection.yaml

only http/vulnerabilities/wordpress/wp-xmlrpc-pingback-detection.yaml

however , wp-xmlrpc-brute-force.yaml also tag as xmlrpc

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-xmlrpc-brute-force.yaml

image