Namespace Kuestenlogik.Bowire.Security.Templates.Nuclei

Classes

NucleiDnsRequest

One entry in the dns: array (#35 Phase 2g). A DNS query (name + record type) plus matchers over the resolved answer — the same word / regex / negative matcher shape HTTP uses, applied to the DNS response instead of an HTTP body.

NucleiHttpRequest

One entry in the http: array. Phase 2a captures the flat single-request shape; multi-step / payload-matrix templates surface in Path as the first listed path.

NucleiInfo

The info: block on a Nuclei template — author, severity, references, tags, the human-readable name + description.

NucleiMatcher

A single matcher rule — one of Nuclei's ~14 matcher types (status / word / regex / size / dsl / binary / …). Phase 2a supports the three most common: status, word, regex.

NucleiMatcherTranslator

Translate a Nuclei Matchers block into Bowire's AttackPredicate tree. Composes matcher-condition (and / or) and matcher-internal value-condition (and / or) onto the predicate's AllOf / AnyOf composites, and folds negative: true through Not.

Phase 2b scope: status, word, regex matcher types — covers most HTTP web-vulnerability templates in the projectdiscovery/nuclei-templates corpus. part: body and the implicit / all are supported; part: header and part: response route through a placeholder that emits null for the matcher (and is logged at the converter level as "skipped — header matching lands in Phase 2b+"). Unknown matcher types likewise emit null — the surrounding predicate-tree just drops the matcher rather than blocking the whole template.

NucleiTemplate

Plain-old representation of a Nuclei YAML template, populated by NucleiTemplateReader. Kept deliberately denormalised (string-valued scalars, list-of-string sequences) so the NucleiTemplateConverter can map onto Bowire's typed recording / predicate shape without first reconstructing Nuclei's own typed object model.

Field surface covers what Phase 2a needs: id, the info block, the first http entry, its first matcher group. Multi-request chains, OAST callbacks, payload matrices, and non-HTTP transports (dns, network, tcp, …) arrive in later phases.

NucleiTemplateConverter

Translate a parsed NucleiTemplate into Bowire's vulnerability-template shape (BowireRecording with Attack set + a populated AttackVulnerability + a built AttackPredicate). The scanner already knows how to execute that shape — no new probe-runner needed, the Nuclei corpus just shows up alongside Bowire's own templates.

Phase 2a — skeleton + identity + info mapping. The matcher → predicate translation lives behind a NotImplementedException guard so consumers see a clear "this part hasn't landed yet" error rather than silent under-coverage. Phase 2b implements status / word / regex matchers; multi-matcher composition + part-selection arrive alongside.

NucleiTemplateReader

Reads a Nuclei YAML template off disk (or any text source) and fills a NucleiTemplate. Uses YamlDotNet's representation-model API directly rather than a typed deserialiser — Nuclei's schema is loose (fields polymorphic across templates, optional sections everywhere), so walking the node tree is more robust against the corpus's actual shape than declaring strict POCOs the deserialiser must hit exactly.

Read methods are static + side-effect-free. Errors from malformed YAML surface as YamlDotNet.Core.YamlException; callers usually catch and report-then-skip the file so a single broken template doesn't kill a 8000-file corpus walk.

NucleiVariableContext

Carries the per-template values the resolver substitutes plus the random source for generated placeholders. Build with FromTarget(string, int?, Func<string>?) for a target URL; the random source defaults to seeded so a given context produces reproducible placeholders across invocations (essential for SARIF diff + CI dashboards).

NucleiVariableResolver

Resolve Nuclei's {{VariableName}} placeholders against a concrete scan target. Nuclei expands these placeholders before sending the HTTP probe; Bowire's scanner doesn't speak the Nuclei DSL, so we replace them at conversion time once the target URL is known.

Phase 2c — the common subset of Nuclei's variable surface:

  • {{BaseURL}} — full base URL: scheme + host + port + base path. https://api.example.com:8443/v2 → https://api.example.com:8443/v2.
  • {{Hostname}} — host + port: api.example.com:8443.
  • {{Host}} — host only: api.example.com.
  • {{Port}} — port if specified, else default (80/443) by scheme.
  • {{Path}} — base-URL path component (rarely used standalone).
  • {{RandStr}} — random alphanumeric string, default length 8.
  • {{RandStr_N}} — random alphanumeric string of length N (e.g. {{RandStr_16}}).
  • {{RandInt}} / {{RandInt_N}} — random integer with N digits (default 6).

Phase 2c+ surface (deferred):

  • DSL helper functions: {{md5(BaseURL)}}, {{base64(...)}}, {{rand_text_alpha(N)}}, {{to_lower(...)}}.

Phase 2f (shipped): {{interactsh-url}} resolves to an out-of-band callback host when an interaction server is configured (InteractshUrlFactory). Without one it passes through untouched, so an OAST template yields no usable probe rather than a meaningless one.