Class NetworkProbeExecutor

Namespace

Kuestenlogik.Bowire.Security.Scanner

Assembly

Kuestenlogik.Bowire.Security.Scanner.dll

Runs a translated Nuclei network: / tcp: template (#491, #35 Phase 2g): open a socket, write the payloads, read the reply, match over it. The shape behind unauthenticated-Redis, exposed-Memcached and banner-grab templates.

public static class NetworkProbeExecutor

Inheritance

object

NetworkProbeExecutor

Inherited Members

object.GetType()

object.MemberwiseClone()

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

Methods

DecodePayload(string)

Turn one converter-written message into bytes. hex: marks a hex-encoded payload (Nuclei's type: hex); everything else is text carrying Go-style escapes.

public static byte[] DecodePayload(string message)

Parameters

message string

Returns

byte[]

DecodeResponse(ReadOnlySpan<byte>)

Render the reply as text for the matchers. Latin-1 rather than UTF-8: a binary banner is not valid UTF-8, and the replacement characters that decoding would produce destroy exactly the byte sequences a word matcher is hunting for. Latin-1 is lossless byte-to-char.

public static string DecodeResponse(ReadOnlySpan<byte> bytes)

Parameters

bytes ReadOnlySpan<byte>

Returns

string

ExecuteAsync(BowireRecordingStep, int, CancellationToken)

Connect, send, read. probe carries the address in Service, the payloads in Messages and the read budget in Metadata["read-size"], as written by the converter.

public static Task<AttackProbeResponse> ExecuteAsync(BowireRecordingStep probe, int timeoutSeconds = 10, CancellationToken ct = default)

Parameters

probe BowireRecordingStep

The recording step to run.

timeoutSeconds int

Connect + read budget.

ct CancellationToken

Cancels the probe.

Returns

Task<AttackProbeResponse>

ParseAddress(string)

Split host:port. A bare host is refused rather than guessed: {{Hostname}} resolves without a port on 80/443, and picking one silently would probe a service the template never named.

public static (string Host, int Port) ParseAddress(string address)

Parameters

address string

Returns

(string Host, int Port)

Unescape(string)

Expand the escapes Nuclei templates write literally in YAML. Without this a PING\r\n goes out as the eight characters P I N G \ r \ n and no Redis answers it — the probe would report "not vulnerable" for a wide-open server.

public static string Unescape(string value)

Parameters

value string

Returns

string