<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Multi-Step Templates — API Reference

## Request Chaining Fields

| Field | Type | Description |
|-------|------|-------------|
| `cookie-reuse` | bool | Persist cookies across requests |
| `redirects` | bool | Follow redirects |
| `max-redirects` | int | Maximum redirect hops |
| `req-condition` | bool | Enable inter-request conditions |

## Response Part Indexing

| Part | Description |
|------|-------------|
| `body_1` | Body of first request |
| `body_2` | Body of second request |
| `header_1` | Headers of first request |
| `header_2` | Headers of second request |
| `status_code_1` | Status of first request |
| `status_code_2` | Status of second request |
| `all_1` | Full response of first request |

## Internal Extractors

```yaml
# Extract value for use in subsequent requests
extractors:
  - type: regex
    name: token         # Variable name: {{token}}
    group: 1
    regex:
      - 'csrf_token=([a-f0-9]+)'
    internal: true      # Don't output, use internally
```

## Flow Protocol (Nuclei v3)

```yaml
# Sequential execution
flow: |
  http("step1") && http("step2") && http("step3")

# Conditional execution
flow: |
  http("login") && http("check") && (contains(body, "admin") && http("exploit"))

# Loop execution
flow: |
  for(let i = 1; i <= 10; i++) {
    set("id", i);
    http("fetch-user");
  }
```

## Interactsh (OOB) Variables

| Variable | Description |
|----------|-------------|
| `{{interactsh-url}}` | Unique interaction URL |
| `interactsh_protocol` | Protocol used (http/dns/smtp) |
| `interactsh_request` | Full interaction request |
| `interactsh_response` | Full interaction response |

## CLI Options for Multi-Step

```bash
# Standard multi-step scan
nuclei -u https://target.com -t multi-step.yaml -json

# With variable overrides
nuclei -u https://target.com -t template.yaml -var username=admin -var password=test

# With interactsh server
nuclei -u https://target.com -t oob-template.yaml -iserver https://interact.sh

# Extended timeout for slow chains
nuclei -u https://target.com -t template.yaml -timeout 30
```
