Nuclei: extracted text is what the template captured

The extract is a capture

Some templates copy a piece of the response into the result: a header value, a title, a version-looking token. That string is what the extractor captured. It is not a second test, and it is not a statement that you verified the software build by another means.

The template id is still the thing that matched. The extracted string is an extra field on that match. Quote them separately so a reader can see which words came from the page and which name is the template.

Do not upgrade the string

A captured banner can look like a product version. Writing “vulnerable build” adds a conclusion the field does not state. If the template’s own name is an informational banner check, say that. If you did not read the template, write “template not read” rather than guessing what the extract proves.

Do not add an attack description because a version string appeared. The result did not include one.

What to file

File the template id, the matched URL, the extractor’s string exactly as printed, and whether you read the template. File the severity label as the template’s label. Do not file a CVE id that the result did not print.

Worked case: a banner filed as a break-in

A lab result has template id tech-detect, matched URL https://status.hackblue-lab.org, and an extracted string nginx. A draft says the status host was broken into because the banner names nginx. The template was not opened. The result prints no advisory id.

The note quotes the template id, the URL, and the extracted string as captured text. It says the template was not read, so the string is not given a meaning beyond capture. There is no advisory in the result, and no incident is opened from the word nginx.

template-id: tech-detect
matched-at: https://status.hackblue-lab.org
extracted: nginx
template text: not read
advisory id in the result: none
write: captured string, not a break-in