<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# HTTP Detection Templates — API Reference

## Nuclei HTTP Protocol Options

```bash
# Basic GET scan
nuclei -u https://target.com -t http-template.yaml -json

# Raw request mode
nuclei -u https://target.com -t raw-template.yaml -json

# With custom headers
nuclei -u https://target.com -t template.yaml -H "Cookie: session=abc123"

# Follow redirects
nuclei -u https://target.com -t template.yaml -follow-redirects

# Rate limited scan
nuclei -u https://target.com -t template.yaml -rate-limit 10 -json
```

## HTTP Request Fields

| Field | Type | Description |
|-------|------|-------------|
| `method` | string | HTTP method (GET, POST, PUT, DELETE, PATCH) |
| `path` | list | URL paths to request (supports `{{BaseURL}}`) |
| `headers` | map | Custom HTTP headers |
| `body` | string | Request body content |
| `raw` | list | Raw HTTP requests (full control) |
| `redirects` | bool | Follow HTTP redirects |
| `max-redirects` | int | Maximum redirect hops (default: 10) |
| `cookie-reuse` | bool | Reuse cookies across requests |
| `host-redirects` | bool | Allow cross-host redirects |
| `stop-at-first-match` | bool | Stop after first matching path |

## Template Variables

| Variable | Description |
|----------|-------------|
| `{{BaseURL}}` | Full target URL with scheme |
| `{{RootURL}}` | Root URL without path |
| `{{Hostname}}` | Target hostname only |
| `{{Host}}` | Hostname with port |
| `{{Port}}` | Target port |
| `{{Path}}` | URL path component |
| `{{Scheme}}` | http or https |

## Matcher Types for HTTP

| Type | Fields | Example |
|------|--------|---------|
| `word` | words, part, condition | Match specific strings in body/header |
| `regex` | regex, part | Pattern match response content |
| `status` | status | Match HTTP status codes |
| `size` | size | Match response content length |
| `binary` | binary | Match binary patterns (hex) |
| `dsl` | dsl | Custom expression matching |

## Extractor Types

| Type | Fields | Purpose |
|------|--------|---------|
| `regex` | regex, group | Extract via regex capture groups |
| `json` | json | Extract via JQ-style JSON path |
| `kval` | kval | Extract key-value pairs from headers |
| `xpath` | xpath | Extract via XPath expressions |
| `dsl` | dsl | Extract via DSL expressions |

## Response Parts

| Part | Content |
|------|---------|
| `body` | Response body |
| `header` | Response headers |
| `all` | Full response (header + body) |
| `status_code` | HTTP status code |
| `content_length` | Response size |
| `content_type` | Content-Type header value |
