# How to Debug ingressnightmare Using Verbose (-v) and Trace (-vv) Modes

> Debug ingressnightmare effectively using verbose (-v) and trace (-vv) modes. Gain essential diagnostics and full HTTP request/response logs to troubleshoot CVE-2025-1974 exploits.

- Repository: [Esonhugh Skyworship/ingressnightmare-cve-2025-1974-exps](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps)
- Tags: how-to-guide
- Published: 2026-03-01

---

**Use the `-v` flag to enable debug-level logging for basic diagnostics, or `-vv` to activate trace-level logging with full HTTP request/response output from the underlying `gout` client.**

The `ingressnightmare` exploit tool includes granular debugging capabilities that help security researchers troubleshoot CVE-2025-1974 exploitation attempts. As implemented in the `esonhugh/ingressnightmare-cve-2025-1974-exps` repository, these modes are controlled through counted verbosity flags that modify both Logrus logging levels and HTTP client transparency.

## Debug Flag Architecture

The debugging system relies on a counted flag mechanism that maps verbosity levels to specific logging behaviors.

### Flag Registration in main.go

In [[`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go)](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go#L90-L93) (lines 90-93), the verbosity flag is defined using Cobra's `CountVarP` method bound to `Opts.Verbose`. This design increments an integer counter for each flag occurrence:

- Single `-v` sets the counter to **1**
- Double `-vv` sets the counter to **2**
- Additional repetitions (e.g., `-vvv`) register as **≥2** (treated identically to `-vv`)

### PersistentPreRun Configuration Logic

Before any command executes, the `PersistentPreRun` hook in [[`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go)](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go#L56-L62) (lines 56-62) translates the counter into concrete logging configurations:

- **When `Opts.Verbose == 1`**: Configures Logrus to `DebugLevel` for detailed diagnostic messages
- **When `Opts.Verbose >= 2`**: Escalates Logrus to `TraceLevel` and sets the package variable `nginx_ingress.Verbose` to `true`

## Verbose vs Trace Mode Comparison

The tool distinguishes between two debugging intensities based on the flag count:

**`-v` (Verbose Mode)**
- Sets Logrus log level to `DebugLevel`
- Enables basic request logging and payload size diagnostics
- Suitable for verifying that uploads reach the target and checking command execution flow

**`-vv` (Trace Mode)**
- Sets Logrus log level to `TraceLevel`
- Activates `nginx_ingress.Verbose` global flag
- Enables full HTTP client debug output via the `gout` library, printing raw request/response headers and bodies
- Essential for analyzing malformed requests or ingress controller rejection responses

Without either flag, the tool defaults to `InfoLevel` logging with minimal output.

## HTTP Client Tracing Implementation

The trace mode's HTTP transparency is implemented in the payload upload logic. In [[`nginx-ingress/exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go)](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go#L94-L101) (lines 94-101), the `Uploader` function (and related `BadUploader`) constructs the HTTP client using the `gout` library:

```go
// Simplified excerpt from exploit.go showing the debug integration
client := gout.POST(u.URL).
    SetHeader(ua).
    SetProxy(u.Proxy).
    SetRetry(2).
    Debug(Verbose)  // Controlled by -vv flag

```

When `Verbose` is `true` (set via `-vv`), the `.Debug(true)` call instructs `gout` to dump the complete raw HTTP transaction to stderr, including binary payload bytes and response headers.

## Practical Debug Usage Examples

Enable basic debugging to verify payload delivery and command execution:

```bash
./ingressnightmare -m c -c 'id' -i https://target-webhook -u http://target-upload -v

```

**Expected output** with `-v`:

```

2026/03/01 12:00:00 DEBUG[0000] Request: POST / HTTP/1.1...
2026/03/01 12:00:00 DEBUG[0000] payload so has been uploaded, size: 1048590 bytes

```

Activate full trace mode to inspect raw HTTP traffic and debug ingress controller interactions:

```bash
./ingressnightmare -m c -c 'id' -i https://target-webhook -u http://target-upload -vv

```

**Expected output** with `-vv`:

```

2026/03/01 12:00:00 TRACE[0000] POST / HTTP/1.1
Host: target-upload
Content-Type: application/octet-stream
Content-Length: 1048576
Connection: keep-alive
Accept: */*

<binary payload bytes …>

```

## Summary

- **Flag mechanism**: Uses `CountVarP` in [`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go) to count `-v` occurrences, where 1 enables debug and 2+ enables trace
- **Log levels**: `-v` sets Logrus to `DebugLevel`; `-vv` sets it to `TraceLevel`
- **HTTP tracing**: `-vv` sets `nginx_ingress.Verbose = true`, which activates `gout` debug mode in [`nginx-ingress/exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go)
- **Use cases**: Use `-v` for general troubleshooting and `-vv` when analyzing HTTP-level failures or ingress controller responses

## Frequently Asked Questions

### What is the difference between `-v` and `-vv` in ingressnightmare?

`-v` enables **debug-level** logging through Logrus, showing high-level diagnostics like request URLs and payload sizes. `-vv` enables **trace-level** logging and additionally activates the `nginx_ingress.Verbose` flag, which causes the `gout` HTTP client to print raw request and response headers and bodies in [`nginx-ingress/exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go).

### Why does the tool use a counted flag instead of separate flags?

The implementation uses Cobra's `CountVarP` in [`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go) (lines 90-93) to create a progressive verbosity scale. This approach allows the `PersistentPreRun` logic to distinguish between three states: default (0), debug (1), and trace (≥2), without cluttering the CLI with multiple distinct flag definitions.

### Can I use `-vvv` or more verbose flags?

While the command parser accepts `-vvv` or higher counts, the code in [`main.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go) (lines 56-62) only distinguishes between `Opts.Verbose == 1` and `Opts.Verbose >= 2`. Three or more `-v` flags produce identical output to `-vv`, setting Logrus to `TraceLevel` and enabling full HTTP debugging.

### Where is the HTTP debug output generated?

The raw HTTP debugging output originates from the `gout` library when configured with `.Debug(true)` in the `Uploader` function within [[`nginx-ingress/exploit.go`](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go)](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go#L94-L101). This function checks the global `Verbose` variable set during `PersistentPreRun` to determine whether to enable transparent HTTP logging.