No valid templates were found

[lc]

Version:

v2.9.7

go version

go version go1.20.5 linux/amd64

Reproduction Steps:

nuclei -t /root/nuclei-templates/http/fuzzing/cache-poisoning-fuzz.yaml -l targets.httpx --debug

Where targets.httpx contains a list of URLs:

http://example.com/
http://another.example.com/

[WRN] Could not load template /root/nuclei-templates/http/fuzzing/cache-poisoning-fuzz.yaml: the template was excluded
[INF] Current nuclei version: v2.9.7 (latest)
[INF] Current nuclei-templates version: v9.5.3 (latest)
[INF] Targets loaded for current scan: 76
[INF] No results found. Better luck next time!
[FTL] Could not run nuclei: no valid templates were found

[MetzinAround]

Hi! Thanks for the issue. This is similar to this answer in another issue, I think. #3713 (comment)

templates with the fuzz tag are excluded by default, you have to use the -itags flag to make sure the fuzzing templates get run.

-itags, -include-tags string[] tags to be executed even if they are excluded either by default or configuration

[ehsandeep]

@lc nuclei -t /root/nuclei-templates/http/fuzzing/cache-poisoning-fuzz.yaml -l targets.httpx -itags fuzz will work; fuzzing templates are excluded as default.

[lc]

Oh whoops, sorry – must've been a change since the last time I tried it

[ldionmarcil]

Hi, could this behaviour be changed, or perhaps the verbiage? When trying to to manually run a tag, for example iis-shortname, the output is quite confusing:

nuclei -u ... -id iis-shortname

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.15

                projectdiscovery.io

[INF] Current nuclei version: v2.9.15 (latest)
[INF] Current nuclei-templates version: v9.6.5 (latest)
[INF] Targets loaded for current scan: 1
[INF] No results found. Better luck next time!
[FTL] Could not run nuclei: no valid templates were found

it took me an embarassing long time to figure out, via -debug, that the template was being "rejected", and I needed to switch from using -id to -t to figure that out:

nuclei -u ... -t "http/fuzzing/iis-shortname.yaml" -debug

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.15

                projectdiscovery.io

[WRN] Could not load template /Users/louis.dionmarcil/nuclei-templates/http/fuzzing/iis-shortname.yaml: the template was excluded
[INF] Current nuclei version: v2.9.15 (latest)
[INF] Current nuclei-templates version: v9.6.5 (latest)
[INF] Targets loaded for current scan: 1
[INF] No results found. Better luck next time!
[FTL] Could not run nuclei: no valid templates were found

and even then, you need to go check that particular template and identify which tag is being excluded, before manually including it on the command line.... that is a little bit of a poor user experience. As a suggestion, could Nuclei perhaps bypass the excluded tags when you manually request a specific template? That would be more logical. Thanks!