azure-cloud-config Profile seems not including templates for azure scan

[avwsolutions]

I'm working on an experiment with Nuclei as a tool for pen testing. Here I'm interested in running a pentest against Azure cloud environments. For this I'm following the blog: Azure Config Review.

Seems that I don't get any good response running nuclei -profile azure-cloud-config

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.3.8

		projectdiscovery.io

[WRN] Excluded 118 template[s] with known weak matchers / tags excluded from default run using .nuclei-ignore
[WRN] Excluded 191 self-contained template[s] (disabled as default), use -esc option to run self-contained templates.
[INF] Current nuclei version: v3.3.8 (latest)
[INF] Current nuclei-templates version: v10.1.1 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] No results found. Better luck next time!
[FTL] Could not run nuclei: no templates provided for scan

I followed the blog and the az login was completed successfully. To verify this I have checked the login with azure nuclei -id azure-env -code.

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.3.8

		projectdiscovery.io

[INF] Current nuclei version: v3.3.8 (latest)
[INF] Current nuclei-templates version: v10.1.1 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 154
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from projectdiscovery/nuclei-templates
[azure-env] [code] [info]  ["Azure CLI is properly configured for environment "AzureCloud"."]```

Also I validated if the specfic ID works. That works well. See below for nuclei -id azure-vm-ssh-auth-type -code

-rw-rw-r-- 1 ad1222 ad1222 1782 Dec 26 13:45 azure-vm-ssh-auth-type.yaml

                   __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.3.8

		projectdiscovery.io

[INF] Current nuclei version: v3.3.8 (latest)
[INF] Current nuclei-templates version: v10.1.1 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 154
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from projectdiscovery/nuclei-templates
[azure-vm-ssh-auth-type] [code] [high]  ["/subscriptions/2223e8b1-dbc7-4d54-8aff-b5e315df5e5b/resourceGroups/1-6CB435DC-SANDBOX/providers/Microsoft.Compute/virtualMachines/sandbox1 is configured with password-based SSH authentication, which is insecure"]

I using the latest version and validated the profile and tags.
I expected that when I included the profile ( nuclei -profile azure-cloud-config) this template was also executed, so also this will show up in the results.

My questions are:

• Is my expectation correct ?
• Is there something I do wrong here?
• Do I miss some configuration?
• Additional steps required?

Help here is appreciated.

[ehsandeep]

@avwsolutions Can you try added -esc option?

nuclei -profile azure-cloud-config -esc

[avwsolutions]

Yes, i've tried this, which shows below about the results, but seems that still python3 processes are running.

                  __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.3.8

		projectdiscovery.io

[INF] Current nuclei version: v3.3.8 (latest)
[INF] Current nuclei-templates version: v10.1.1 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 154
[INF] Templates loaded for current scan: 191
[INF] Executing 191 signed templates from projectdiscovery/nuclei-templates
[INF] No results found. Better luck next time!

What I do see is that when I run this with the --debug flag I see them executed, but the system hangs/too busy to response. The VM which runs the scan has 4 cores, 8gb memory. Seems that it isn't completed yet.

Is there a way to make the sessions less and make the scan more system resource friendly ?

[avwsolutions]

Noticed that it also hangs after a while when the scan is started without the debug flag. Also limiting the concurrency (to 1 for all concurrency options) seems not to work.

Making smaller scanning targets (templates) using tags helps to minimize the load, but still I expected the same result with limiting the concurrency to 1.