projectdiscovery/nuclei · error

no extracted values found for template: %s

Error message

no extracted values found for template: %s

What it means

After executing the dynamic-secret template, the callback (internal/runner/lazy.go:142) requires at least one extracted value to store in d.Extracted; execution succeeding with zero values is treated as failure. The template either defines no extractors or none of its extractors matched the target's responses — matcher-only detection templates will always fail here. The error names the template path for follow-up.

Source

Thrown at internal/runner/lazy.go:142

						data[k] = value
					}
				}
			}
			// named extractors
			for k, v := range e.OperatorsResult.Extracts {
				if len(v) > 0 {
					data[k] = v[0]
				}
			}
			// log result of template in result file/screen
			_ = writer.WriteResult(e, opts.ExecOpts.Output, opts.ExecOpts.Progress, opts.ExecOpts.IssuesClient)
		}
		_, execErr := tmpl.Executer.ExecuteWithResults(ctx)
		if execErr != nil {
			finalErr = execErr
		}
		if finalErr == nil && len(data) == 0 {
			finalErr = fmt.Errorf("no extracted values found for template: %s", d.TemplatePath)
		}
		// store extracted result in auth context
		d.Extracted = data
		if finalErr != nil && opts.OnError != nil {
			opts.OnError(finalErr)
		}
		return finalErr
	}
}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Add named extractors to the template for every secret it must yield (tokens, cookies, session ids)
2. Test the template directly (`nuclei -t auth.yaml -u <target> -v`) and confirm values are extracted
3. Verify the input/target configured for the dynamic secret is reachable and returns the expected response
4. Ensure gating matchers actually match so extractors run

Example fix

# before
http:
  - method: GET
    path: "{{BaseURL}}/login"
    matchers:
      - type: status
        status: [200]

# after
http:
  - method: GET
    path: "{{BaseURL}}/login"
    extractors:
      - type: kval
        name: session_token
        kval:
          - "session_token"
    matchers:
      - type: status
        status: [200]

// before registering a dynamic secret, require extractors on the template
parsed, err := templates.Parse(templateFile, nil, options)
if err != nil { return err }
hasExtractors := false
for _, p := range parsed.Protocols {
    if len(p.GetOperators().Extractors) > 0 { hasExtractors = true }
}
if !hasExtractors {
    return errors.New("dynamic secret template defines no extractors")
}

if finalErr == nil && len(data) == 0 {
    finalErr = fmt.Errorf("template %s extracted nothing; check extractors and target reachability", d.TemplatePath)
    opts.OnError(finalErr)
}

When it happens

Trigger: Auth template without extractors; extractors present but not matching the actual responses; the target (d.Input) unreachable or returning different content than the template expects; matcher conditions preventing extractor evaluation.

Common situations: Reusing detection templates (matcher-only) as dynamic secret sources without adding extractors; target service responding differently than when the template was authored; expired credentials changing response content.

Related errors

• failed to load templates: %w
• %w for path: %s
• multiple templates found for path: %s
• Invalid protocol type: {valueToMap}
• invalid workflow with no templates or tags

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/fd49b730ccf96b9b. Report an issue: GitHub.