projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

Home Page:https://github.com/projectdiscovery/nuclei

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

这几个poc会让内存爆炸程序停止/These files will cause memory explosion and program errors

NGP1100 opened this issue · comments

Am I the only one who has encountered this kind of problem?只有我碰见这种问题吗?( ̄▽ ̄)~*

Snipaste_2024-04-23_21-55-46

11111

Snipaste_2024-04-23_21-51-43
Snipaste_2024-04-23_21-54-12

Hi @NGP1100, Thank you for taking the time to create this issue, the team will looking into it.

Please provide the steps to reproduce the behavior, at minimum the full command line and give an idea of how many targets you are scanning

I'm having the same problem, and using a process of elimination to go through each one, the following will cause the cpu and memory to explode

[pgsql-file-read] PostgreSQL File Read (@pussycat0x) [high]
[pgsql-list-database] PostgreSQL List Database (@pussycat0x) [high]
[pgsql-list-password-hashes] PostgreSQL List Password Hashes (@pussycat0x) [high]
[pgsql-list-users] PostgreSQL List Users (@pussycat0x) [high]
[pgsql-version-detect] Postgresql Version - Detect (@pussycat0x) [high]

I'm temporarily modifying the configuration file to temporarily use

exclude-tags:
  - postgresql

.\nuclei.exe -u https://xxx.com:8085 -profile .\config\base.yml

I don't know why, but in version 3.1.10 does not have this problem

Can you confirm if the latest release doesn’t have this issue? If it doesn’t, we can close the issue. @dflife @NGP1100

1
I updated to the new version and still have the same problem.This can be reproduced directly by executing the following command
.\nuclei.exe -duc -stats -u https://lqjdc.fsecity.com:8085 -t C:\Users\root\nuclei-templates\javascript\enumeration\pgsql\pgsql-file-read.yaml

This is being addressed in projectdiscovery/nuclei#5188