[Authenticated scan]If the token is used in a certain field of json in the request body， How to define secret-file.yaml

[cgct]

Hi, team,

Thank you for your time and assistance.

i want to ask If the token is used in a certain field of json in the request body， How to define secret-file.yaml?

current,my settings are blow:

secret-file

# dynamic secrets
dynamic:
  - template: login.yaml
    variables:
      - key: username
        value: admin
      - key: password
        value: admin
    input: https://192.168.11.1 # optional input/target, not required if target is hardcoded in template
    # once login is successful, this can be used in below templatized static secret
    type: query
    domains-regex:
        - 192.168.11.1
    params:
      - key: token
        value: "{{token}}"
        internal: true

login.yaml

    extractors:
      - type: regex
        part: body
        name: token
        group: 1
        regex:
          - '"token":"([a-zA-Z0-9]{32})"'
        internal: true

the request must login

{
    "id": 20,
    "jsonrpc": "2.0",
    "method": "call",
    "params":
    [
        "{{token}}",
    ]
}

problems

it always return error:
unresolved variables found: token

[GeorginaReeder]

Hi there @cgct , thanks for your question!

Tagging @dwisiswant0 to check this out.

[dwisiswant0]

Since {{token}} will be served as a variable, you can check out the details here: https://docs.projectdiscovery.io/tools/nuclei/authenticated-scans#variables.