The debug flags do not work correctly with headless templates

[forgedhallpass]

trafficstars

Request and response headers are not shown when the -debug, -debug-req, -debug-resp flags are provided.

The headless action execution messages should be formatted (e.g. by adding [DBG] prefix) and some context should also be given (e.g. "Executing headless action: waitload").

It would also be nice to show the actual URL, instead of {{BaseURL}}.

nuclei -t headless.yaml -u https://twitter.com -headless -debug

id: headless
info:
    name: Headless Example
    severity: info
    author: forgedhallpass

headless:
  - steps:
      - action: navigate      
        args:
          url: "{{BaseURL}}"
      - action: waitload

[Techbrunch]

I don't know if it is the same issue but I believe that the debug action inside an headless template also does not work.

[Mzack9999]

Note: it's expected that HTTP requests/responses aren't shown as browser navigation might imply multiple asynchronous network activities to complete an action (e.g. asynchronous javascript libraries loading, ajax requests, etc.).

[forgedhallpass]

Note: it's expected that HTTP requests/responses aren't shown as browser navigation might imply multiple asynchronous network activities to complete an action (e.g. asynchronous javascript libraries loading, ajax requests, etc.).

This is true, but requests made explicitly through a template should still be shown. e.g. in this case: https://github.com/projectdiscovery/nuclei/issues/2365#issuecomment-1199183495

[Mzack9999]

After discussing with @forgedhallpass :

• [ ] Debug messages should have placeholders ({{placeholder}}) replaced with their final values
• [ ] It might not be possible to relate an asynchronous specific HTTP request with a template YAML action. Anyway that's necessary to check if various actions' debug messages are detailed enough and eventually update them to provide as much context as possible
• [ ] All error messages should be at least printed as warnings

[forgedhallpass]

It actually shows the dumped response, but without header. Also as we've seen, the hijacked response struct in go-rod contains a request id, hence the correlation should be possible.

docker pull vulnerables/web-dvwa
docker run --rm -it -p 80:80 vulnerables/web-dvwa

nuclei -id dvwa-headless-automatic-login -u http://localhost -headless -debug

We could at least make sure the proxy configuration is being properly propagated to the web browser. That would be a viable alternative.