Skip to content

Fix/nuclei without template cache pvc #858

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
J12934 merged 2 commits into from
Dec 8, 2021
Merged

Fix/nuclei without template cache pvc #858

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ef451b9
Only include `-no-update-templates` option when using the templateCache
J12934 Dec 6, 2021
79aa0dd
Add docs on how to install nuclei without the template cache
J12934 Dec 6, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions scanners/nuclei/.helm-docs.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,19 @@ STATISTICS:
{{- end }}

{{- define "extra.chartConfigurationSection" -}}
## Install Nuclei without Template Cache CronJob / PersistentVolume

Nuclei uses dynamic templates as its scan rules, these determine which requests are performed and which responses are considered to be a finding.
These templates are usually dynamically downloaded by nuclei from GitHub before each scan. When you are running dozens of parallel nuclei scans you quickly run into situations where GitHub will rate limit you causing the scans to fail.
To avoid these errors we included a CronJob which periodically fetches the current templates and writes them into a kubernetes PersistentVolume (PV). This volume is then mounted (as a `ReadOnlyMany` mount) into every scan so that nuclei scans have the up-to-date templates without having to download them on every scan.

Unfortunately not every cluster supports the required `ReadOnlyMany` volume type.
In these cases you can disable the template cache mechanism by setting `nucleiTemplateCache.enabled=false`.
Note thought, that this will limit the number of scans you can run in parallel as the rate limit will likely cause some of the scans to fail.

```bash
helm install nuclei secureCodeBox/nuclei --set="nucleiTemplateCache.enabled=false"
```
{{- end }}

{{- define "extra.scannerLinksSection" -}}
Expand Down
14 changes: 14 additions & 0 deletions scanners/nuclei/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,20 @@ STATISTICS:

Kubernetes: `>=v1.11.0-0`

## Install Nuclei without Template Cache CronJob / PersistentVolume

Nuclei uses dynamic templates as its scan rules, these determine which requests are performed and which responses are considered to be a finding.
These templates are usually dynamically downloaded by nuclei from GitHub before each scan. When you are running dozens of parallel nuclei scans you quickly run into situations where GitHub will rate limit you causing the scans to fail.
To avoid these errors we included a CronJob which periodically fetches the current templates and writes them into a kubernetes PersistentVolume (PV). This volume is then mounted (as a `ReadOnlyMany` mount) into every scan so that nuclei scans have the up-to-date templates without having to download them on every scan.

Unfortunately not every cluster supports the required `ReadOnlyMany` volume type.
In these cases you can disable the template cache mechanism by setting `nucleiTemplateCache.enabled=false`.
Note thought, that this will limit the number of scans you can run in parallel as the rate limit will likely cause some of the scans to fail.

```bash
helm install nuclei secureCodeBox/nuclei --set="nucleiTemplateCache.enabled=false"
```

## Values

| Key | Type | Default | Description |
Expand Down
2 changes: 2 additions & 0 deletions scanners/nuclei/templates/nuclei-scan-type.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,9 @@ spec:
imagePullPolicy: {{ .Values.scanner.image.pullPolicy }}
command:
- "nuclei"
{{ if .Values.nucleiTemplateCache.enabled }}
- "-no-update-templates"
{{ end }}
- "-json"
- "-output"
- "/home/securecodebox/nuclei-results.jsonl"
Expand Down