diff --git a/pkg/fuzz/execute.go b/pkg/fuzz/execute.go index 4f33ba6ddc..8eb57f6b40 100644 --- a/pkg/fuzz/execute.go +++ b/pkg/fuzz/execute.go @@ -167,9 +167,12 @@ func (rule *Rule) evaluateVarsWithInteractsh(data map[string]interface{}, intera if rule.options.Interactsh != nil { // Iterate through the data to replace and evaluate variables with Interactsh URLs for k, v := range data { + value := fmt.Sprint(v) // Replace variables with Interactsh URLs and collect new URLs - got, oastUrls := rule.options.Interactsh.Replace(fmt.Sprint(v), interactshUrls) - + got, oastUrls := rule.options.Interactsh.Replace(value, interactshUrls) + if got != value { + data[k] = got + } // Append new OAST URLs if any if len(oastUrls) > 0 { interactshUrls = append(interactshUrls, oastUrls...) diff --git a/pkg/fuzz/parts.go b/pkg/fuzz/parts.go index 6ab1643296..86e1df9f93 100644 --- a/pkg/fuzz/parts.go +++ b/pkg/fuzz/parts.go @@ -181,9 +181,9 @@ func (rule *Rule) execWithInput(input *ExecuteRuleInput, httpReq *retryablehttp. // for fuzzing. func (rule *Rule) executeEvaluate(input *ExecuteRuleInput, _, value, payload string, interactshURLs []string) (string, []string) { // TODO: Handle errors - values := generators.MergeMaps(input.Values, map[string]interface{}{ + values := generators.MergeMaps(rule.options.Variables.GetAll(), map[string]interface{}{ "value": value, - }, rule.options.Options.Vars.AsMap(), rule.options.Variables.GetAll()) + }, rule.options.Options.Vars.AsMap(), input.Values) firstpass, _ := expressions.Evaluate(payload, values) interactData, interactshURLs := rule.options.Interactsh.Replace(firstpass, interactshURLs) evaluated, _ := expressions.Evaluate(interactData, values)