Class NucleiMatcherTranslator

Namespace
Kuestenlogik.Bowire.Security.Templates.Nuclei
Assembly
Kuestenlogik.Bowire.Security.Templates.Nuclei.dll

Translate a Nuclei Matchers block into Bowire's AttackPredicate tree. Composes matcher-condition (and / or) and matcher-internal value-condition (and / or) onto the predicate's AllOf / AnyOf composites, and folds negative: true through Not.

Phase 2b scope: status, word, regex matcher types — covers most HTTP web-vulnerability templates in the projectdiscovery/nuclei-templates corpus. part: body and the implicit / all are supported; part: header and part: response route through a placeholder that emits null for the matcher (and is logged at the converter level as "skipped — header matching lands in Phase 2b+"). Unknown matcher types likewise emit null — the surrounding predicate-tree just drops the matcher rather than blocking the whole template.

public static class NucleiMatcherTranslator
Inheritance
NucleiMatcherTranslator
Inherited Members

Methods

Translate(NucleiHttpRequest)

Build the full predicate tree for the matchers on one HTTP request. Returns null when no matcher translated — the caller treats that as "this template has no actionable predicate, will not fire" (visible non-silent outcome).

public static AttackPredicate? Translate(NucleiHttpRequest http)

Parameters

http NucleiHttpRequest

Returns

AttackPredicate

Translate(IReadOnlyList<NucleiMatcher>, string)

Build the predicate tree for a bare matcher list + its composition condition — shared across transports (HTTP + the Phase-2g dns pass, which reuses the same word / regex / negative matcher shape over the resolved DNS answer).

public static AttackPredicate? Translate(IReadOnlyList<NucleiMatcher> matchers, string matchersCondition)

Parameters

matchers IReadOnlyList<NucleiMatcher>
matchersCondition string

Returns

AttackPredicate