nuclei: [issue] panic: runtime error: invalid memory address or nil pointer dereference

Describe the bug I was running a test to see if I could run most of the templates with a single call to a url. This is the custom workflow I ran by echoing in a single url to nuclei.

id: unguided
info:
  name: Workflow to run most of the templates
  author: Jeffrey Shran

variables:
  cves: cves/
  default_credentials: default-credentials/
  dns: dns/
  files: files/
  generic_detections: generic-detections/
  panels: panels/
  security_misconfiguration: security-misconfiguration/
  subdomain_takeover: subdomain-takeover/
  technologies: technologies/
  tokens: tokens/
  vulnerabilities: vulnerabilities/

logic:
  |
  cves()
  default_credentials()
  dns()
  files()
  generic_detections()
  panels()
  security_misconfiguration()
  subdomain_takeover()
  technologies()
  tokens()
  vulnerabilities()

The command I ran is as follows:

echo "https://example.com" | nuclei -c 200 -t ~/unguided.yaml -o example_com.nuclei.unguided

Nuclei runs for 30-45 seconds then produces the error in the screenshot below.

Nuclei version Current Version: 2.1.0

Screenshot of the error or bug

About this issue

Original URL
State: closed
Created 4 years ago
Comments: 19 (12 by maintainers)

Most upvoted comments

Confirmed on the first 5s. after running v2.1, thanks @JeffreyShran

$ cat urls.txt | ./nuclei -c 200 -t ./unguided.yml -o example_com.nuclei.unguided

leak

vzamanillo on Aug 26, 2020

@bauthard I was pushing it to see what could be done. yaml file below. I was running it on 2738 hosts.

@vzamanillo At idle - RAM 180MB/3.8GB CPU 3.1%. No I ran it without anything else running in the background. (other than the usual system stuff)

id: do-the-lot
info:
  name: Workflow to run all templates
  author: @JeffreyShran

variables:
  cves: cves
  default_credentials: default-credentials
  dns: dns
  files: files
  generic_detections: generic-detections
  panels: panels
  payloads: payloads
  security_misconfiguration: security-misconfiguration
  subdomain_takeover: subdomain-takeover
  technologies: technologies
  tokens: tokens
  vulnerabilities: vulnerabilities
  workflows: workflows

# Comment out below what you don't want to call.
logic:
  |
  cves()
  default_credentials()
  dns()
  files()
  generic_detections()
  panels()
  payloads()
  security_misconfiguration()
  subdomain_takeover()
  technologies()
  tokens()
  vulnerabilities()
  workflows()

JeffreyShran on Aug 25, 2020

@bauthard Yes! Thank you (again!) Seems to be running fine now.

JeffreyShran on Aug 25, 2020

This should be fixed in master code @JeffreyShran

ehsandeep on Aug 24, 2020

Nothing to add, but I just wanted to say thanks for helping to debug the issue @vzamanillo - I wouldn’t know where to begin!

JeffreyShran on Aug 24, 2020