设置pipeline: true后burp无法获取到数据
在yaml文件中设置pipeline: true,执行nuclei中加入-p http://127.0.0.1:8080,burp无请求数据
C:\Users\17569\Desktop\nuclei-poc\nacos>nuclei -u http://127.0.0.1:202/ -p http://127.0.0.1:8080 -debug -v -vv -t 1.yaml
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.3.0
projectdiscovery.io
[VER] Using http://127.0.0.1:8080 as proxy server
[VER] Started metrics server at localhost:9092
[WRN] Found 30 template[s] loaded with deprecated paths, update before v3 for continued support.
[INF] Current nuclei version: v3.3.0 (latest)
[INF] Current nuclei-templates version: v9.9.2 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 67
[INF] Templates loaded for current scan: 1
[WRN] Loading 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[cs] cs (@cs) [critical]
[INF] [cs] Dumped HTTP request for http://127.0.0.1:202/
GET /1.php HTTP/1.1
Host: 127.0.0.1:202
User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
[VER] [cs] Sent HTTP request to http://127.0.0.1:202/
[DBG] [cs] Dumped HTTP response http://127.0.0.1:202/
HTTP/0.0 400 Bad Request
Content-Length: 150
Connection: close
Content-Type: text/html
Date: Tue, 06 Aug 2024 09:03:47 GMT
Server: nginx
<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<hr><center>nginx</center>
</body>
</html>
[INF] No results found. Better luck next time!
id: cs
info:
name: cs
author: cs
severity: critical
tags: cs
http:
- method: GET
path:
- "{{BaseURL}}/1.php"
pipeline: true
matchers:
- type: status
status:
- 200
translation: title: Setting pipeline: true prevents burp from fetching data. desc: Set pipeline: true in yaml file, add -p http://127.0.0.1:8080 to execute nuclei, burp no request data
It seems that the pipeline feature is based on the rawhttp, which does not support http proxy.
谢谢大佬的讲解(Thank you very much.) pipeline bool Pipeline defines if the attack should be performed with HTTP 1.1 Pipelining All requests must be idempotent (GET/POST). This can be used for race conditions/billions requests.
管道布尔 管道定义攻击是否应该使用HTTP 1.1管道执行 所有请求必须是幂等的(GET/POST)。这可用于竞争条件/数十亿次请求。