How to Debug ingressnightmare Using Verbose (-v) and Trace (-vv) Modes

Use the -v flag to enable debug-level logging for basic diagnostics, or -vv to activate trace-level logging with full HTTP request/response output from the underlying gout client.

The ingressnightmare exploit tool includes granular debugging capabilities that help security researchers troubleshoot CVE-2025-1974 exploitation attempts. As implemented in the esonhugh/ingressnightmare-cve-2025-1974-exps repository, these modes are controlled through counted verbosity flags that modify both Logrus logging levels and HTTP client transparency.

Debug Flag Architecture

The debugging system relies on a counted flag mechanism that maps verbosity levels to specific logging behaviors.

Flag Registration in main.go

In [main.go](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go#L90-L93) (lines 90-93), the verbosity flag is defined using Cobra's CountVarP method bound to Opts.Verbose. This design increments an integer counter for each flag occurrence:

• Single -v sets the counter to 1
• Double -vv sets the counter to 2
• Additional repetitions (e.g., -vvv) register as ≥2 (treated identically to -vv)

PersistentPreRun Configuration Logic

Before any command executes, the PersistentPreRun hook in [main.go](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/main.go#L56-L62) (lines 56-62) translates the counter into concrete logging configurations:

• When Opts.Verbose == 1: Configures Logrus to DebugLevel for detailed diagnostic messages
• When Opts.Verbose >= 2: Escalates Logrus to TraceLevel and sets the package variable nginx_ingress.Verbose to true

Verbose vs Trace Mode Comparison

The tool distinguishes between two debugging intensities based on the flag count:

-v (Verbose Mode)

• Sets Logrus log level to DebugLevel
• Enables basic request logging and payload size diagnostics
• Suitable for verifying that uploads reach the target and checking command execution flow

-vv (Trace Mode)

• Sets Logrus log level to TraceLevel
• Activates nginx_ingress.Verbose global flag
• Enables full HTTP client debug output via the gout library, printing raw request/response headers and bodies
• Essential for analyzing malformed requests or ingress controller rejection responses

Without either flag, the tool defaults to InfoLevel logging with minimal output.

HTTP Client Tracing Implementation

The trace mode's HTTP transparency is implemented in the payload upload logic. In [nginx-ingress/exploit.go](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go#L94-L101) (lines 94-101), the Uploader function (and related BadUploader) constructs the HTTP client using the gout library:

// Simplified excerpt from exploit.go showing the debug integration
client := gout.POST(u.URL).
    SetHeader(ua).
    SetProxy(u.Proxy).
    SetRetry(2).
    Debug(Verbose)  // Controlled by -vv flag

When Verbose is true (set via -vv), the .Debug(true) call instructs gout to dump the complete raw HTTP transaction to stderr, including binary payload bytes and response headers.

Practical Debug Usage Examples

Enable basic debugging to verify payload delivery and command execution:

./ingressnightmare -m c -c 'id' -i https://target-webhook -u http://target-upload -v

Expected output with -v:

2026/03/01 12:00:00 DEBUG[0000] Request: POST / HTTP/1.1...
2026/03/01 12:00:00 DEBUG[0000] payload so has been uploaded, size: 1048590 bytes

Activate full trace mode to inspect raw HTTP traffic and debug ingress controller interactions:

./ingressnightmare -m c -c 'id' -i https://target-webhook -u http://target-upload -vv

Expected output with -vv:

2026/03/01 12:00:00 TRACE[0000] POST / HTTP/1.1
Host: target-upload
Content-Type: application/octet-stream
Content-Length: 1048576
Connection: keep-alive
Accept: */*

<binary payload bytes …>

Summary

• Flag mechanism: Uses CountVarP in main.go to count -v occurrences, where 1 enables debug and 2+ enables trace
• Log levels: -v sets Logrus to DebugLevel; -vv sets it to TraceLevel
• HTTP tracing: -vv sets nginx_ingress.Verbose = true, which activates gout debug mode in nginx-ingress/exploit.go
• Use cases: Use -v for general troubleshooting and -vv when analyzing HTTP-level failures or ingress controller responses

Frequently Asked Questions

What is the difference between -v and -vv in ingressnightmare?

-v enables debug-level logging through Logrus, showing high-level diagnostics like request URLs and payload sizes. -vv enables trace-level logging and additionally activates the nginx_ingress.Verbose flag, which causes the gout HTTP client to print raw request and response headers and bodies in nginx-ingress/exploit.go.

Why does the tool use a counted flag instead of separate flags?

The implementation uses Cobra's CountVarP in main.go (lines 90-93) to create a progressive verbosity scale. This approach allows the PersistentPreRun logic to distinguish between three states: default (0), debug (1), and trace (≥2), without cluttering the CLI with multiple distinct flag definitions.

Can I use -vvv or more verbose flags?

While the command parser accepts -vvv or higher counts, the code in main.go (lines 56-62) only distinguishes between Opts.Verbose == 1 and Opts.Verbose >= 2. Three or more -v flags produce identical output to -vv, setting Logrus to TraceLevel and enabling full HTTP debugging.

Where is the HTTP debug output generated?

The raw HTTP debugging output originates from the gout library when configured with .Debug(true) in the Uploader function within [nginx-ingress/exploit.go](https://github.com/esonhugh/ingressnightmare-cve-2025-1974-exps/blob/main/nginx-ingress/exploit.go#L94-L101). This function checks the global Verbose variable set during PersistentPreRun to determine whether to enable transparent HTTP logging.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}