[BUG] Length of variable {{interactsh-url}} computed incorrectly

[darses]

Is there an existing issue for this?

• I have searched the existing issues.

Current Behavior

The dsl function len("{{interactsh-url}}") returns the length of the literal text {{interactsh-url}}. This makes it impossible to compute the length of a payload that includes an interact.sh domain.

Expected Behavior

Make the DSL function len() return the length on the expanded {{interactsh-url}} URL.

Steps To Reproduce

Relevant log output

Environment

- OS: Fedora Linux
- Nuclei: v3.4.7
- Go: go1.24.4

Anything else?

I see two solutions:

1. Compute the correct length for the expanded variable, so the entire domein
2. Provide a second variable {{interact-len}} if computing it dynamically is impossible

Maybe this issue belongs in the projectdiscovery/nuclei repository, but I am not sure on that.

[ehsandeep]

@darses This should work!

variables:
  oast: "{{interactsh-url}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    extractors:
      - type: dsl
        dsl:
          - len(oast)

[basic-example] [http] [info] https://example.com ["41"]

[ehsandeep]

it needs to be initialized before using it.

[darses]

A bit mangled to provide a minimum example. And also note that I am using this oast variable as a network input. The len(cmd) is still computed as 35, instead of the actual length of 59.

variables:
  oast: "{{interactsh-url}}"
  cmd: "curl${IFS}http://{{oast}}"
  payload2: "{{len(cmd)}} , {{cmd}}"

extractors:
  - type: dsl
    dsl:
      - len(oast)

00000000  33 35 20 2c 20 63 75 72  6c 24 7b 49 46 53 7d 68  |35 , curl${IFS}h|
00000010  74 74 70 3a 2f 2f 64 32  67 34 6c 74 32 76 34 70  |ttp://d2g4lt2v4p|
00000020  76 31 34 36 70 32 30 70  33 30 79 73 35 74 63 37  |v146p20p30ys5tc7|
00000030  36 64 73 6f 79 37 74 2e  6f 61 73 74 2e 70 72 6f  |6dsoy7t.oast.pro|

[darses]

@ehsandeep Sorry for not replying in the thread. Have you seen my comment about using the len() inside the network input? This is where I get the length mismatch.