Class SslProbeExecutor

Namespace

Kuestenlogik.Bowire.Security.Scanner

Assembly

Kuestenlogik.Bowire.Security.Scanner.dll

Runs a translated Nuclei ssl: template (#491, #35 Phase 2g): complete a TLS handshake and match over the certificate the peer presented.

public static class SslProbeExecutor

Inheritance

object

SslProbeExecutor

Inherited Members

object.GetType()

object.MemberwiseClone()

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

Remarks

No trust is ever granted. The probe has to see certificates a normal client rejects — expired, self-signed, wrong-host — because those are the findings. It does that without accepting any of them: the validation callback copies the certificate and returns false, which aborts the handshake immediately after the certificate message. That is everything the matchers need and nothing more, and it means the scanner never completes a TLS session with a peer it could not verify. The alternative — a callback that returns true unconditionally — would be both a weaker posture and a CA5359 suppression.

The cost is the negotiated protocol and cipher, which are only known once a handshake finishes. Those are not lost: the scanner's built-in checks already enumerate TLS versions on the target.

What the matcher sees. The certificate renders into one body, one field: value per line, so word and regex matchers work against it. Nuclei's own dsl matchers (not_after < now) still do not translate — that is a translator-wide gap, not an ssl one — so the derived expired / self_signed lines below give word matchers something to hit for the two cases templates ask for most.

Methods

ExecuteAsync(BowireRecordingStep, int, DateTimeOffset?, CancellationToken)

Handshake against the step's address and render the peer certificate.

public static Task<AttackProbeResponse> ExecuteAsync(BowireRecordingStep probe, int timeoutSeconds = 10, DateTimeOffset? now = null, CancellationToken ct = default)

Parameters

probe BowireRecordingStep

The recording step to run; Service is host:port.

timeoutSeconds int

Connect + handshake budget.

now DateTimeOffset?

Clock for the derived expiry lines; injected so the test does not have to mint a certificate that expires while it runs.

ct CancellationToken

Cancels the probe.

Returns

Task<AttackProbeResponse>

ParseAddress(string)

Split host:port for an ssl: address. Unlike the network transport a missing port defaults to 443 — an ssl: template without one unambiguously means "the TLS port", where a raw socket template does not.

public static (string Host, int Port) ParseAddress(string address)

Parameters

address string

Returns

(string Host, int Port)

Render(X509Certificate2, DateTimeOffset)

Flatten a certificate into the body matchers read. Field names follow Nuclei's own vocabulary so a template's words land on something recognisable.

public static string Render(X509Certificate2 certificate, DateTimeOffset now)

Parameters

certificate X509Certificate2

now DateTimeOffset

Returns

string