Nuclei: a result line is a template match

Matchers passed, on this URL

A result names a template id, a URL in matched-at, and a severity taken from the template. That means the template’s matchers succeeded on the response to that URL. It does not mean the condition your policy cares about is true, and it does not mean the severity is an incident category.

The template’s name and message are the author’s words, the same way a rule message is. Quote them as the template’s text if you need them. The evidence you can check is the id and the URL.

Open the response before you file the policy

Matchers can succeed on a status or a body you did not intend. If the policy is about a login page, the URL has to be that page, and the status has to be the one the template was written for. A match on a different path is still a match. It is not yet the policy failure.

Write “template matched” until someone has looked at the status and the path. After that look, either confirm the policy sentence or say the match was on a different response.

What to file

File the template id, the severity label, the matched URL, the time of the run, and whether a person opened the response. If the result includes a matcher name, file that too. Do not raise the severity because the template id sounds serious. Do not describe an attack the template did not print.

Worked case: a header check on a 404

A lab run reports template id http-missing-security-headers, severity info, matched-at https://lab-status.hackblue-lab.org/missing. A draft says the login page does not send HSTS. Opening the URL shows status 404. The path is not /login.

The note quotes the template id, the URL, the severity label, and “404, not the login page.” The match stands as a matcher result. It is not filed as a failed login baseline. The login URL, if it needs checking, is a separate request.

Snippet

template-id: http-missing-security-headers
severity: info (label on the template)
matched-at: https://lab-status.hackblue-lab.org/missing
opened: yes, status 404
policy “login sends HSTS”: not this response

Diagram

From a result line to a sentence you can file

Id
Which template matched.
Field
```
template-id
```
URL
Where it matched.
Field
```
matched-at
```
Label
The severity the template carries.
Label
```
not an incident category
```
Look
Status and path, if the policy names them.
Check
```
404 on /missing is not /login
```

Check yourself

1. What does a Nuclei result establish by itself?

2. The matched URL is /missing and the status is 404. The draft says the login page lacks a header. What is wrong?

3. Why quote severity as a label?