How to judge when two matchers rule conflict(coverage)?

[t43Wiu6]

there is a fingerprint in nuclei-templates/blob/master/technologies/tech-detect.yaml

    matchers-condition: or
    matchers:
      - type: word
        name: apache
        words:
          - "Apache"
        part: header

and i append some rules

      - type: word
        name: apache
        words:
          - "Apache"
        part: header
      - type: word
        name: tomcat
        words:
          - "successfully installed Tomcat"
        part: body

the detect result is tomcat when i got a page that meets both criteria， it depends on what?
Is there a possibility that could be a conflict would interfere with normal fingerprint identification.
I had already try to modify the sequence, always hapend.

[ehsandeep]

@t43Wiu6 we define matchers condition in the template, in this case it's OR, so you will see match when either of the condition is matched, the idea of this template is make all the tech-based fingerprints with name: attribute, so you get all matched technology in use for given URLs.

    matchers-condition: or

If you wanted to write a template which requires more conditions or AND condition, it is suggested to write a separate template.

[t43Wiu6]

I know that i can see the match value when the condition is matched.

In my test case, I got a page resp just like this

HTTP/1.1 200 OK
...
Server: Apache-Coyote

successfully installed Tomcat

of course, will match both, it make me feel confused.

the match result is tomcat, why not apache?is that mean the result will be apahce in sometime?because it satisfies both...

in workflow template, this may cause the wrong poc to be used

[ehsandeep]

@t43Wiu6 because as default, matcher looking within response body, unless you specified where to look for.

You can use part: all and if you want to look into the body and header at the same time, part: header if you only want to look into the header.

[t43Wiu6]

oops，it seems that you didnt got me
i have defind part: body already...

      - type: word
        name: apache
        words:
          - "Apache"
        part: header
      - type: word
        name: tomcat
        words:
          - "successfully installed Tomcat"
        part: body

matcher looking the key word successfully installed Tomcat in exp body，should return true
and when it looking the header，there
is another rules ，match result shoud be true too.

so the latest result is a magic? Obviously, it cannot be both Tomcat and Apache，because the result just return one word.

[ehsandeep]

@t43Wiu6 to avoid possible confusion, it is possible for you to share an example template and host with expected behavior vs the results causing confusion?

[t43Wiu6]

Sorry to see this too later. frustratingly, I didn't find a solution to this problem
although it is rare to have two fingerprints, it can happen.
in my opinion, when multiple fingerprints are matched, it might be better to output them all to replace output one
finger dectect result will be "tomcat, apache", juicy

[forgedhallpass]

@t43Wiu6

Soon we will merge some improvements and corrections with regards to matchers:
#999 - will color the matches in the responses
#1083 - will show the AND matchers
#1082 - will only show the matched OR matcher only
#1084 - will show matched matchers that don't have an explicit name