Extractors value lost when I add three requests.

[tylerdurden2010]

Nuclei version: 2.5.3

Current Behavior:

Template

id: Permssion_Checking
info:
  name: Test Permssion Process
  author: xxx
  severity: info
requests:
  - raw:
      - |
        POST /v1/roles HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Content-Length: 104

        {"description": "this is a test role","org": "§org§","name": "fxv34312d2"}
      - |
        PUT /v1/roles/§nameid§/members HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Content-Length: 71
        TestHeader: §nameid§

        {"org": "§org§","members": [{"member_id":§userid§}]}
      - |
        POST /v1/roles/create HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Content-Length: 39

        {"id": [77],"name_id": §nameid§}
    extractors:
      - type: json
        name: nameid
        part: body
        internal: true
        json:
          - '.role.id'
    matchers:
      - type: word
        words:
          - "accessToken"

When the process runs the third request, the value of nameid will be lost.

Expected Behavior:

name_id has the value from nameid.

Steps To Reproduce:

nuclei -t ./Permssion_Checking.yaml -u http://test.com -proxy http://127.0.0.1:8080 -V org=test -V userid=17 -v

Anything else:

[forgedhallpass]

@tylerdurden2010 try removing the internal: true from the json extractor

[tylerdurden2010]

Hi @forgedhallpass , thanks for kindly replying, I did as you said, but §nameid§ can not retrieve the value when I removed the "internal: true". The second request path changed as PUT /v1/roles/%C2%A7nameid%C2%A7/members not PUT /v1/roles/number/members

@tylerdurden2010 try removing the internal: true from the json extractor

[forgedhallpass]

@tylerdurden2010 I've missed that you were using the extracted value in the request. Try duplicating the extractor, the first with internal: true and the second without.

[ehsandeep]

@forgedhallpass duplicate extractor might not be needed as extracted value is used internally in the request and not for printing it.

@tylerdurden2010 if doesn't work, feel free to join the discord server and tag or dm pdteam as we need more information before we can suggest the fix.

[ehsandeep]

req-condition can be used to specify specfic request while using matcher/extractor, for example:-

    req-condition: true
    extractors:
      - type: regex
        part: body_1
        regex:
          - "XXX"

      - type: regex
        part: body_2
        regex:
          - "XXX"