Interface IOastClient
- Namespace
- Kuestenlogik.Bowire.Oast
- Assembly
- Kuestenlogik.Bowire.Oast.dll
The out-of-band interaction seam (#35 Phase 2f). A probe plants a callback host in the target; if the target resolves or fetches it, the interaction server records the callback and the scanner polls it back — which is the only way to detect a blind vulnerability (SSRF / RCE / XXE) where the response itself carries no evidence.
public interface IOastClient : IAsyncDisposable- Inherited Members
Remarks
Implementations are opt-in by construction: the scanner has no client unless the operator passed an interaction server, so a scan never reaches a third party by default.
Properties
ServerDomain
The interaction-server domain callbacks are addressed under (e.g.
oast.example.com). Surfaced so findings can name where the
evidence was collected.
string ServerDomain { get; }Property Value
Methods
Allocate()
Reserve a fresh callback host for one probe. Cheap + local after the session is registered — allocation does not round-trip per call.
OastAllocation Allocate()Returns
PollAsync(CancellationToken)
Fetch the interactions the server has recorded for this session since the last poll. Returns only new ones; correlate them to a probe via FullId / UniqueId.
Task<IReadOnlyList<OastInteraction>> PollAsync(CancellationToken ct = default)Parameters
Returns
RegisterAsync(CancellationToken)
Register this session with the interaction server. Callbacks for a correlation id the server has not seen registered are dropped, so a caller that plants payloads before polling must register first. Idempotent — calling it again is a no-op.
Task RegisterAsync(CancellationToken ct = default)