Class OastWorkbenchSession

Namespace

Kuestenlogik.Bowire.Security.Scanner

Assembly

Kuestenlogik.Bowire.Security.Scanner.dll

The long-lived OAST session behind the manual pen-test panel (#486). One session per workbench process: the operator generates callback payloads, pastes them into whatever they're testing by hand, and watches the feed for the target reaching back — the interactive counterpart to the scanner's automated --oast-server path.

public sealed class OastWorkbenchSession : IAsyncDisposable

Inheritance

object

OastWorkbenchSession

Implements

IAsyncDisposable

Inherited Members

object.GetType()

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

Remarks

Registration is eager on the first payload, not deferred to the first poll: the interaction server drops callbacks for a correlation id it has not seen registered, so a payload handed out before registration would silently lose any callback it caught. All payloads share one correlation id, so one poll drains every probe's callbacks.

Configured from Bowire:Oast:Server / Bowire:Oast:Token. With no server set, Configured is false and the panel shows how to enable it rather than pretending to work.

Constructors

OastWorkbenchSession(string?, string?)

Create the session from the configured server + token (either may be null).

public OastWorkbenchSession(string? server, string? token)

Parameters

server string

token string

Properties

ConfigError

Reason the configured server URL was rejected, or null.

public string? ConfigError { get; }

Property Value

string

Configured

Whether an interaction server is configured and usable.

public bool Configured { get; }

Property Value

bool

ServerDomain

The interaction-server domain callbacks are addressed under, or null.

public string? ServerDomain { get; }

Property Value

string

Methods

AllocateAsync(CancellationToken)

Hand out a fresh callback host to plant. Registers the session first if needed. Throws InvalidOperationException when no server is configured — the endpoint maps that to a clear 409, not a 500.

public Task<string> AllocateAsync(CancellationToken ct = default)

Parameters

ct CancellationToken

Returns

Task<string>

DisposeAsync()

public ValueTask DisposeAsync()

Returns

ValueTask

PollAsync(CancellationToken)

The full accumulated feed after draining any new callbacks from the server. Returns the whole feed (not just the delta) so the panel can poll at its own cadence and always render the complete history. Empty when no server is configured.

public Task<IReadOnlyList<OastCallback>> PollAsync(CancellationToken ct = default)

Parameters

ct CancellationToken

Returns

Task<IReadOnlyList<OastCallback>>