Option to disable templates auto-updates

[savushkin-yauheni]

Hi team.

Am i wright that templates could be autoupdated ?

If yes, can we disable it by any flag ?

Because there is a strange logic. e.x. i override template, but after autoupdate it reverted to original version and it leads to some bugs.

Thanks

[ehsandeep]

@savushkin-yauheni to disable auto-update, as of now you can just manually change the version in the config file to avoid the update, can you also list the issue you are facing after the update?

[savushkin-yauheni]

Thanks for response!

Do you mean .templates-config.json and last-checked-ignore prop ?

can you also list the issue you are facing after the update

It specific to my logic. so it's not a problem in nuclei =)

Btw. Maybe we need a flag to disable autoupdate ?

Thanks!

[savushkin-yauheni]

@ehsandeep I check the code and it's a bad bypass i think.

FIrstly i shoud bypass this. So i could change last-checked-ignore to any date in future, it's okay.

nuclei/v2/internal/runner/update.go

Line 122 in 76fe4c6

if r.templatesConfig.CurrentVersion == "" || (r.options.TemplatesDirectory != "" && r.templatesConfig.TemplatesDirectory != r.options.TemplatesDirectory) {

Secondly this one. But it's hard to enter in this section. Server could work more than one day with old templates, so to bypass it i should dynamically change the date every 24 hours =(

nuclei/v2/internal/runner/update.go

Line 157 in 76fe4c6

if time.Since(r.templatesConfig.LastChecked) < 24*time.Hour && !r.options.UpdateTemplates {

Thanks

[geeknik]

Because there is a strange logic. e.x. i override template, but after autoupdate it reverted to original version and it leads to some bugs.

Is it possible to copy the template(s) to a new directory, make your changes, and then add an exclusion for the original template(s) that get auto-updated? This way the auto-update doesn't revert your changes.

[savushkin-yauheni]

Hi @geeknik
Yeah, sure. It's a valid bypass. But if a lot of templates, it's not very easy, as just add "no-auto-update" option,
And anyway it's a hack trick . May be my case is very unique, but i think not, so just suggest to add a flag. It would be great.

[ehsandeep]

we can surely add support to disable auto updates.

[ehsandeep]

@savushkin-yauheni you can disable auto-update by having update-templates: false in your config file.

[savushkin-yauheni]

Hi @ehsandeep

nuclei/v2/internal/runner/update.go

Line 85 in 76fe4c6

if r.templatesConfig == nil || time.Since(r.templatesConfig.LastCheckedIgnore) > 1*time.Hour || r.options.UpdateTemplates {

Do you mean to bypass this ? But it wouldn't work as i understand. Or did you change something in another place ?

Thanks!

[savushkin-yauheni]

Hi @ehsandeep
Was i right ? It still doesn't work in 2.4.1 ?

[ehsandeep]

@savushkin-yauheni Yes, you are right, looks like we need to have another option if we wanted to stop auto-updates, we will add it, just we know can you share example use cases for this or just a personal preference?

[savushkin-yauheni]

@ehsandeep sure, but i think they are very specific for my purposes.

https://github.com/projectdiscovery/nuclei-templates/blob/63398e83bf2e989b1c4189268b66f33a5cda80e8/network/vsftpd-detection.yaml

So, templates like that. They use more than one host with port. But if I detected ports before - it would be redundant requests. So i in this kind of templates i just removed everything except "{{Hostname}}"
Sure i can just copy templates, but as i think: editing is more suitable way.

https://github.com/projectdiscovery/nuclei-templates/blob/b43c97360e81c0f29f57f42b6131cc071d810f42/exposures/tokens/generic/credentials-disclosure.yaml

Contains a lot of false positives if you scan a lot of assets ( from gau or smth like this ). Just removed some very trashy lines or edit them.

I understand that i can bypass all cases just by coping templates. But if i'm not alone with that kind of problem, so it would be great to add a new option ;)

Thanks for amazing tool!