mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-20 15:21:30 +02:00
Yogesh OjhaandClaude Opus 5
d7c8b6e01f
Blind injection is invisible unless the target calls back, and reNgine had the switch and the server field without either of the two things that make them work. nuclei's -interactions-cooldown-period defaults to 5 seconds: it stops polling five seconds after its last request, so a callback a queue, a cron or a report generator fires minutes later is never heard. oast_wait_minutes (default 5) is the one operator-facing number and drives both that and -interactions-eviction, because a request evicted from nuclei's cache before its callback arrives leaves the callback with nothing to attribute it to — eviction is always the wait plus slack. A self-hosted server is normally token-gated and -interactsh-token was never passed, so a configured server silently fell back to the public one and the callbacks went somewhere the operator does not own. The token is an APIProvider.INTERACTSH row — encrypted at rest and masked on read like every other key — rather than a stage field, because an OAST server is instance infrastructure, not a per-engine choice. _oast_server() reduces whatever is typed to a bare host: nuclei wants the host, and a scheme or trailing path makes it register nowhere and fall back without saying so. redact_command now matches on how a flag ends rather than on the whole word. -interactsh-token was redacted only by the accident of the pattern matching its -token suffix, while nuclei's own short form -itoken wrote the secret straight into scan_commands. What this deliberately is not: reNgine owning an interactsh session of its own — registering a correlation id, decrypting polled interactions and injecting its own payloads on the probe path. That is a package the size of connectors/, and the only way to hear a callback for a request nuclei did not send. 20 tests. Two mutations survived the first cut — an empty token row becoming `-interactsh-token ""`, and the token being read for a run that will not use it — because the tests built options directly instead of going through the scanner. Both are covered and dead now. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013dKUV96WkQQETZBMoAG98C