projectdiscovery/nuclei · error

invalid attack type: %s

Error message

invalid attack type: %s

What it means

Raised by toAttackType when a fuzzing attack type string, after TrimSpace + ToLower, is not one of attackTypeMappings: 'batteringram', 'pitchfork' or 'clusterbomb' (attack_types.go:27-31,48). It surfaces either directly from AttackTypeHolder.UnmarshalYAML/UnmarshalJSON when a template's fuzzing attack field is invalid, or wrapped as 'could not parse custom attack-type' when a generator is created with a custom attack type in generators.go.

Source

Thrown at pkg/protocols/common/generators/attack-types.go:48

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Use one of: batteringram, pitchfork, clusterbomb
2. Remember the value is case-insensitive but must be a single word ('clusterbomb', not 'cluster bomb')
3. Validate fuzzing templates with nuclei -validate before a campaign

Example fix

# before
attack: sniper
# after
attack: batteringram

var validAttackTypes = map[string]bool{"batteringram": true, "pitchfork": true, "clusterbomb": true}
func attackTypeOK(s string) bool { return validAttackTypes[strings.ToLower(strings.TrimSpace(s))] }

When it happens

Trigger: A fuzz block with attack: sniper (Metasploit-style name), attack: cluster bomb, or attack: BatteringRam is fine but attack: ram is not; a SDK caller passing an arbitrary string to the generator's custom attack type.

Common situations: Porting fuzz configs from wfuzz/ffuf/Burp vocabulary; typos and spaces in the attack name; templates written against forks with extra attack modes.

Related errors

• batteringram must have single payload set
• validation failed for these fields
• Invalid severity: %s
• Invalid extractor type: %s
• Invalid matcher type: %s

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/dc1ab869c1f392ac. Report an issue: GitHub.