unresolved variables found: interactsh-url

[abdulx01]

Hi, Team @ehsandeep What wrong with my nuclei, and interactsh tool
I am not getting OBB interaction on my http raw request or base request.

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.10

                projectdiscovery.io

[WRN] Found 1 templates loaded with deprecated protocol syntax, update before v3 for continued support.
[INF] Current nuclei version: v2.9.10 (outdated)
[INF] Current nuclei-templates version: v9.6.2 (latest)
[INF] New templates added in latest release: 61
[INF] Templates loaded for current scan: 1
[INF] Targets loaded for current scan: 1
[WRN] [referer_bssrf] Could not make http request for https://0af300bf046b2a23803adfa600c70077.web-security-academy.net/product?productId=1: unresolved variables found: interactsh-url
[INF] No results found. Better luck next time!

And I check health for it:

root@AbdulRahman ~/f/ssrf (main)# nuclei -hc

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.10

                projectdiscovery.io

Version: v2.9.10
Operating System: linux
Architecture: amd64
Go Version: go1.20.6
Compiler: gc
File "/root/.config/nuclei/config.yaml" Read => Ok
File "/root/.config/nuclei/config.yaml" Write => Ok
File "/root/.config/nuclei/.nuclei-ignore" Read => Ok
File "/root/.config/nuclei/.nuclei-ignore" Write => Ok
File "/root/nuclei-templates/.checksum" Read => Ok
File "/root/nuclei-templates/.checksum" Write => Ok
IPv4 connectivity to scanme.sh:80 => Ok
IPv6 connectivity to scanme.sh:80 => Ko (dial tcp6 [2400:6180:0:d0::91:1001]:80: connect: network is unreachable)
IPv4 UDP connectivity to scanme.sh:53 => Ok

Is this the reason why I am getting obb interaction ?

And I also check interacth tool but same on that.
Could not register to http://oast.live: could not make register request: POST https://oast.live/register giving up after 1 attempts: Post "https://oast.live/register": dial tcp: lookup oast.live on 172.17.0.1:53: no such host, retrying with http

[FTL] Could not create client: could not register to servers: could not make register request: POST http://oast.site/register giving up after 1 attempts: Post "http://oast.site/register": dial tcp: lookup oast.site on 172.17.0.1:53: no such host

And Same health in this tool.

Please help me where I am wrong.

[ehsandeep]

@abdulx01 can you share the same information after updating nuclei to the latest version?

[abdulx01]

Yes, Sure
I think that problem is solve after update, but I am not getting result.

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.14

                projectdiscovery.io

[WRN] Found 1 templates loaded with deprecated protocol syntax, update before v3 for continued support.
[INF] Current nuclei version: v2.9.14 (latest)
[INF] Current nuclei-templates version: v9.6.2 (latest)
[INF] New templates added in latest release: 61
[INF] Templates loaded for current scan: 1
[INF] Targets loaded for current scan: 1
[INF] Using Interactsh Server: oast.pro
[INF] [referer_bssrf] Dumped HTTP request for https://0a44008c03c8cba380623f7b00a30005.web-security-academy.net/product?productId=2

GET /product?productId=2 HTTP/1.1
Host: 0a44008c03c8cba380623f7b00a30005.web-security-academy.net
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Referer: https://cjupc9alj06cfqqkt900qe9ho68xzxhrr.oast.pro
Accept-Encoding: gzip

[INF] No results found. Better luck next time!

Although It's use that interactsh server but don't matching http or dns interaction.

[ehsandeep]

@abdulx01 can you share the template as well?

[abdulx01]

Yes, sure

id: referer_bssrf

info:
  name: Referer Blind SSRF with out of band interaction
  author: abdul
  severity: low

requests:
  - method: GET
    path:
      - "{{BaseURL}}"
    payloads:
      ssrf:
        - "{{interactsh-url}}"
    headers:
      Referer: "https://{{ssrf}}"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol 
        words:
          - "http"
          - "dns"

[abdulx01]

Lab: https://portswigger.net/web-security/ssrf/blind/lab-out-of-band-detection

[AlLongley]

Note that this error also occurs when you are specifying your own self-hosted "interactsh" server and either:

• Your connection failed to the custom interactshserver (invalid host, typo, network issue)
• Your token is incorrect

nuclei -tags oast -debug -interactsh-server MYINTERACTSHSERVER -interactsh-token AAAA -u https://MYTARGET

There's no warning even in "-debug" to indicate anything is wrong with your supplied arguments, only that "interactsh-url" is an unresolved variable

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.3.4

                projectdiscovery.io

[^[[34mINF^[[0m] Current nuclei version: v3.3.4 (^[[92mlatest^[[0m)
[^[[34mINF^[[0m] Current nuclei-templates version: v10.0.1 (^[[92mlatest^[[0m)
[^[[93mWRN^[[0m] Scan results upload to cloud is disabled.
[^[[34mINF^[[0m] New templates added in latest release: 86
[^[[34mINF^[[0m] Templates loaded for current scan: 225
[^[[34mINF^[[0m] Executing 225 signed templates from projectdiscovery/nuclei-templates
[^[[34mINF^[[0m] Targets loaded for current scan: 1
[^[[33mWRN^[[0m] [CVE-2016-1555] Could not make http request for https://MYTARGET: unresolved variables found: interactsh-url
[^[[33mWRN^[[0m] [CVE-2016-10108] Could not make http request for https://MYTARGET: unresolved variables found: interactsh-url
[^[[33mWRN^[[0m] [CVE-2019-2767] Could not make http request for https://MYTARGET: unresolved variables found: interactsh-url
[^[[33mWRN^[[0m] [CVE-2018-10562] Could not make http request for https://MYTARGET: unresolved variables found: interactsh-url,interactsh-url