Class DnsProbeExecutor

Namespace
Kuestenlogik.Bowire.Security.Scanner
Assembly
Kuestenlogik.Bowire.Security.Scanner.dll

Runs a translated Nuclei dns: template (#491, #35 Phase 2g).

public static class DnsProbeExecutor
Inheritance
DnsProbeExecutor
Inherited Members

Remarks

The recording step carries the query: Service is the name to resolve and Method the record type, as written by NucleiTemplateConverter.

What the matcher sees. Body carries the answer section only, one record per line. That is a deliberate narrowing of Nuclei, whose DNS matchers can address question / authority / additional / raw separately while Bowire's predicate model has a single body. Rendering the whole response instead would let a word match the echoed question section — and since the question contains the very name the template asked for, templates like "does this CNAME point at {{FQDN}}-something" would fire on every lookup. Refusing to widen costs a detection; widening invents one, which is the same trade NucleiMatcherTranslator already makes for dropped conjuncts.

Methods

ExecuteAsync(BowireRecordingStep, IDnsAnswerSource, CancellationToken)

Resolve the step's query and shape the answer into the response the predicate evaluator consumes.

public static Task<AttackProbeResponse> ExecuteAsync(BowireRecordingStep probe, IDnsAnswerSource source, CancellationToken ct = default)

Parameters

probe BowireRecordingStep
source IDnsAnswerSource
ct CancellationToken

Returns

Task<AttackProbeResponse>

ParseRecordType(string)

Map a Nuclei record-type string onto DnsClient's query type. Throws rather than silently falling back to A: a template asking for TXT and being answered with A records would be judged against the wrong data.

public static QueryType ParseRecordType(string recordType)

Parameters

recordType string

Returns

QueryType