You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Since my user database has 8 records, the sleep(7) would be executed 8 times, in total 56 seconds to be waited until my response is received, and by default nuclei timeout is 10 seconds, so im getting an timeout error here.
Is there an existing issue for this?
Current Behavior
I attempt to run a blind-time-based-sql template on my own local server that deliberately designed to be vulnerable to sql injection. Template I used is from this link:
https://docs.projectdiscovery.io/templates/protocols/http/fuzzing-examples#blind-time-based-sqli-template
So i ran it with this simple command :
nuclei -t blind-time-based-sql.yaml -u "http://127.0.0.1:3939/login?username=john" -v -dast
And in one of the response it shows...
[mysql-blind-time-based-sqli] Error occurred in request: GET http://127.0.0.1:3939/login?username='+/+sleep(7)+/+' giving up after 2 attempts: Get "http://127.0.0.1:3939/login?username='+/+sleep(7)+/+'": net/http: timeout awaiting response headers
Since my user database has 8 records, the sleep(7) would be executed 8 times, in total 56 seconds to be waited until my response is received, and by default nuclei timeout is 10 seconds, so im getting an timeout error here.
However even if i use -timeout flag :
nuclei -t blind-time-based-sql.yaml -u "http://127.0.0.1:3939/login?username=john" -v -dast -timeout 100
, the error still persists, leaving the vulnerable endpoint undetected.
Expected Behavior
-timeout flag should be set properly to my timeout value.
Steps To Reproduce
1
Relevant log output
Environment
Anything else?
No response
The text was updated successfully, but these errors were encountered: