search

projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
https://docs.projectdiscovery.io/tools/nuclei
MIT License
20.72k stars 2.51k forks source link

bug with response read timeout flag #5213

Closed zerokeeper closed 5 months ago

zerokeeper commented 5 months ago

Hello, there is a bug with the -response-read-timeout (-rrt) flag. it doesn't work.

if the response time more than 5s.It can't receive response successfully. Even though I set the time and rrt to a longer time, it still has no effect. nuclei -u url -t test.yaml -dast -timeout 10 -rrt 10

I still think that the rrt flag and the timeout flag are duplicated and bring new bugs. Even if this bug is fixed, it seems that these two flags need to be set when setting timeout in the future. Can I cancel it?

The similar issues: https://github.com/projectdiscovery/nuclei/issues/5111

tarunKoyalwar commented 5 months ago

@zerokeeper , currently -rrt flag is specific to network protocol templates and does not affect templates , as for http response body read timeout it is 3 x timeout flag value , since there have been recent changes related to timeouts we are trying to derive timeouts from a single flag see https://github.com/projectdiscovery/nuclei/issues/5214

tarunKoyalwar commented 5 months ago

i am converting this to discussion, we have implemented various fixes directly related to nuclei and speed as well as error related improvements https://github.com/projectdiscovery/nuclei/pull/5148

If suggest you wait for nuclei release ( which most probably be today), and check if you are still facing the issue , if so then share more details including target , template the actual error as well as error log -elog file.log output

if it is private target/template , feel free to dm us in discord and we will reproduce this behaviour and triage