Passive mode and raw requests #1326

rivalsec · 2021-12-03T14:43:12Z

rivalsec
Dec 3, 2021

Hello! Is there any way to disable templates with raw request on passive mode? These give a lot of false positives.

ehsandeep · 2021-12-03T15:18:16Z

ehsandeep
Dec 3, 2021
Maintainer

@rivalsec Could you add more details to this, cmd/screenshots, or steps to reproduce? based on available information I'm not sure what went wrong.

1 reply

rivalsec Dec 3, 2021
Author

Steps to reproduce, by example "frp-default-login" tempate

make http response file with a "proxies" word in it (filename: example.com.txt)

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 303977
Cache-Control: max-age=604800
Content-Type: text/html; charset=UTF-8
Date: Fri, 03 Dec 2021 15:27:35 GMT
Etag: "3147526947"
Expires: Fri, 10 Dec 2021 15:27:35 GMT
Last-Modified: Thu, 17 Oct 2019 07:18:26 GMT
Server: ECS (dcb/7EEE)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 1256
Connection: close

<!doctype html>
<html>
<head>
    <title>Example Domain</title>
-------------------------------> proxies <-------------------------
    <meta charset="utf-8" />
    <meta http-equiv="Content-type" content="text/html; charset=utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1" />

Start nuclei in passive mode in same folder:
nuclei -passive -t default-logins/frps/ -u *

and my results:


                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   2.5.3

		projectdiscovery.io

[WRN] Use with caution. You are responsible for your actions.
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[INF] Using Nuclei Engine 2.5.3 (latest)
[INF] Using Nuclei Templates 8.6.8 (latest)
[INF] Using Interactsh Server https://interactsh.com
[INF] Templates added in last update: 52
[INF] Templates loaded for scan: 1
[2021-12-03 20:39:22] [frp-default-login] [http] [high] example.com.txt

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ProjectDiscovery

Passive mode and raw requests #1326

{{title}}

Replies: 1 comment 1 reply

{{title}}

{{title}}

Select a reply

ProjectDiscovery

Passive mode and raw requests #1326

rivalsec Dec 3, 2021

Replies: 1 comment · 1 reply

ehsandeep Dec 3, 2021 Maintainer

rivalsec Dec 3, 2021 Author

rivalsec
Dec 3, 2021

Replies: 1 comment 1 reply

ehsandeep
Dec 3, 2021
Maintainer

rivalsec Dec 3, 2021
Author