ProjectDiscovery
Scan Results Are Inconsistent #2504
Replies: 9 comments 3 replies
-
|
Not confirmed, could be related: |
Beta Was this translation helpful? Give feedback.
-
|
Hi @beyildirim, the issue seems to be related to the end server. While trying to request By default. nuclei uses a very low timeout of 5 seconds after which requests are cancelled which seems to be what is causing the inconsistent results. If you try running the scan with a longer timeout value, the results appear to be consistent. |
Beta Was this translation helpful? Give feedback.
-
|
I thought I had the same problem, while discussing with a colleague we realized that we did not necessarily have the same results and that by pushing a little the tests, we have indeed inconsistencies Using a custom template, each time some detections were missed, on the following screenshot, only 5 cases on 8 are detected :
Despite using a lower concurrency or rate limit, the results were still inconsistent. Whereas by just scanning the vulnerable target, I constantly have the vulnerability
Increasing the timeout as suggested by @Ice3man543, indeed allows to detect all cases. Although it seems to be a solution, I still have a doubt because the target only takes a while to respond when I use Nuclei and scan several targets at the same time (I use the If I scan the target directly, the response is almost immediate Regards |
Beta Was this translation helpful? Give feedback.
-
|
Hello, @Ice3man543 Are there any new updates regarding @JoshuaMart s update on the ticket? I have done other tests with different targets. Results are still inconsistent. |
Beta Was this translation helpful? Give feedback.
-
|
@beyildirim Thank you for helping us on this, Could you retry the same test with the latest version of nuclei? also, possible to share another example as http://php.testsparker.com/phpinfo.php is not accessible anymore? |
Beta Was this translation helpful? Give feedback.
-
|
FWIW I'm seeing the same behavior with the latest version. Catches 2-4 of 8 matches from list of 40 targets, 1 in 10 tries will catch all 8 even with timeout set to 15 and rl set to 2. Same behavior on multiple systems. I don't think it's a timeout issue because they load up fine with curl or in a browser. Again, FWIW. |
Beta Was this translation helpful? Give feedback.
-
|
@bradleman do you have more information to share that can be used to replicate? |
Beta Was this translation helpful? Give feedback.
-
|
What additional information do you want? I see there's a new release 2.7.7 so I'll update and try the test again. |
Beta Was this translation helpful? Give feedback.
-
|
input (if it's specific to any target) and cmd to replicate this behavior. |
Beta Was this translation helpful? Give feedback.
-
|
@beyildirim @bradleman @JoshuaMart I was running some more tests with the latest release, and it seems the results are consistent, but let me know if you still notice otherwise. while true; do echo total: `nuclei -u http://php.testsparker.com -id exposed-svn -silent | wc`; done
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1
total: 1 |
Beta Was this translation helpful? Give feedback.
-
|
Hello @ehsandeep , these are the results I got today, and the target is alive. Let me know if I can provide you with more info regarding it.
|
Beta Was this translation helpful? Give feedback.
-
|
also, moving this ticket to the discussion as currently this behavior can not be reproduced or requires more information for the investigation, and as @Ice3man543 suggested, the default value for the timeout is increased in the dev version and will be reflected in next release. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Nuclei version:
2.7.5
Current Behavior:
I'm initiating a scan to a known vulnerable URL with the same custom template. Sometimes it's finding, and sometimes it's not.
Expected Behavior:
It should be showing the same results.
Steps To Reproduce:
Anything else:
I think that's not related to the default nuclei-templates phpinfo exposure script. It's like some packet sending/receiving issue.
Additionally, this vulnerable URL has a phpinfo: http://php.testsparker.com/phpinfo.php and the phpinfo.yaml script has that directory as a path.
Beta Was this translation helpful? Give feedback.
All reactions