InteractSH token

[ocervell]

I use the -iserver and -itoken flags to pass a custom InteractSH URL / token, but can the latter be passed through other means (like env variable) ? The resulting cmdline will have the token in the cmd, which can be problematic on some envs and lack basic security.

Having a default that pulls from 'INTERACTSH_TOKEN' env variable would be nice, what do you think ?

[Mehrdoost]

hey @ocervell , yea u can actually just set NUCLEI_INTERACTSH_TOKEN as an env var.
nuclei picks it up automatically — same as most other flags, just uppercase it
and slap a NUCLEI_ prefix on it. so -itoken becomes that env var.

if both the flag and the env var are present, the env var usually wins (or at
least it's handled in the config merging). so no leaky cmdline, all good.

if u run nuclei -h and scroll the flags section, they list the env var
mappings there too. it's not as obvious in the docs but it's def supported.

if that solves it mark it as answer,

[zxelzy]

Hi @ocervell

Thanks for bringing this up. You have highlighted a very valid security point—passing sensitive credentials like -itoken directly via command-line arguments is indeed an anti-pattern. It leaves the token exposed to process monitoring tools (e.g., ps, top, /proc filesystem) and shell history logs.

While implementing a fallback to an INTERACTSH_TOKEN environment variable is an excellent feature request, you can actually resolve this exposure issue immediately by utilizing Nuclei's native YAML configuration engine.

You can securely persist your custom Interactsh server and token inside your config.yaml file (typically located at $HOME/.config/nuclei/config.yaml).

Simply append the following key-value pairs to the config:

# ~/.config/nuclei/config.yaml
interactsh-url: "https://your-custom-interactsh-url.com"
interactsh-token: "your-secure-token"

Once defined, the Nuclei engine will automatically parse and load these parameters at runtime during initialization, completely eliminating the need to pass -iserver or -itoken in your CLI execution string.