search

yogeshojha / rengine

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.
https://yogeshojha.github.io/rengine/
GNU General Public License v3.0
7.5k stars 1.14k forks source link

bug: Vulnerabilities Discovered 0 #1365

Open zinwelzl opened 3 months ago

zinwelzl commented 3 months ago

Is there an existing issue for this?

Current Behavior

Test URL with lot of vulns, rengine 2.1.2. last update, Vulnerabilities Discovered 0.

All work great, but after today update, no vulns discovered.

Expected Behavior

Vulnerabilities Discovered should have vulns, this is my test site.

Steps To Reproduce

Full scan

Environment

- reNgine: 2.1.2

last update

Anything else?

No response

github-actions[bot] commented 3 months ago

👋 Hi @zinwelzl, Issues is only for reporting a bug/feature request. Please read documentation before raising an issue https://rengine.wiki For very limited support, questions, and discussions, please join reNgine Discord channel: https://discord.gg/azv6fzhNCE Please include all the requested and relevant information when opening a bug report. Improper reports will be closed without any response.

zinwelzl commented 2 months ago

ZAP and others tools find more then 50 vulns, even there is more, but regine after update 0 vulns.

zinwelzl commented 2 months ago

https://ginandjuice.shop/ also no vulns with rengine, other tools find vuls

lintianyuan666 commented 1 month ago

I found this bug too.No vulns found whit rengine,and no subdomain found too.

jimmyn88 commented 1 month ago

Has anyone solved the problem?

yogeshojha commented 1 month ago

@lintianyuan666 no subdomains? which tools are you using in yaml for subdomain enum?

lintianyuan666 commented 1 month ago

@lintianyuan666 no subdomains? which tools are you using in yaml for subdomain enum?

default tools.proberly subfinder

jimmyn88 commented 1 month ago

Anyway, manually running Nuclei with the same command as reNgine, but replacing /usr/src/scan_results/juice-shop.herokuapp.com_10/urls_unfurled.txt with the URL (juice-shop.herokuapp.com), it successfully returns vulnerabilities. The issue seems to be that the urls_unfurled.txt file is empty.

jimmyn88 commented 1 month ago

Can I ask how the file urls_unfurled.txt is generated? Which method does the platform use to make it?