Class ScanOptions

Namespace
Kuestenlogik.Bowire.Security.Scanner
Assembly
Kuestenlogik.Bowire.Security.Scanner.dll

Bag of bowire scan CLI options resolved from System.CommandLine.

public sealed class ScanOptions
Inheritance
ScanOptions
Inherited Members

Constructors

ScanOptions() 

public ScanOptions()

Properties

Active

#395–#400: opt into the active (mutating / aggressive) scan tier. Off by default. When set, active protocol probes run — they may PUBLISH to the target, hold connections open, or open many streams. Each namespaces + cleans up its side effects, but this is a deliberate mutation of the target, so it must never be implicit.

public bool Active { get; init; }

Property Value

bool

ActiveConcurrency

Concurrency budget for fan-out active probes. Default 100.

public int ActiveConcurrency { get; init; }

Property Value

int

ActiveDurationSeconds

Wall-clock budget (seconds) for time-based active probes. Default 15.

public int ActiveDurationSeconds { get; init; }

Property Value

int

ActiveExpectedTopics

Operator-supplied expected-topic scope for the MQTT wildcard-subscribe active probe (#396).

public IList<string> ActiveExpectedTopics { get; init; }

Property Value

IList<string>

AllowSelfSignedCerts 

public bool AllowSelfSignedCerts { get; init; }

Property Value

bool

AuthFlowPath

#190: path to a headless auth-flow JSON file. When set, the recorded login → token chain runs once before the scan and the captured token is injected as an auth header ahead of AuthHeaders. Null = no flow (use AuthHeaders directly).

public string? AuthFlowPath { get; init; }

Property Value

string

AuthHeaders

Auth headers applied to every HTTP-class probe (template + builtin). Each entry is a Name: Value string, e.g. "Authorization: Bearer <token>" or "X-Api-Key: <key>". Repeatable on the CLI. Without an auth header, scans of authenticated APIs are blind — every probe lands on the login wall and the scanner reports false "endpoint missing" findings.

public IList<string> AuthHeaders { get; init; }

Property Value

IList<string>

AuthHeadersB

A second identity's auth headers (--auth-header-b), same shape as AuthHeaders. Used by cross-identity checks — the API1 BOLA probe reads an object as identity A and then tries the same object as identity B to detect a missing object-level authorization check. Empty = single-identity scan (BOLA probe skips).

public IList<string> AuthHeadersB { get; init; }

Property Value

IList<string>

CveDbPath

#187: path to a CVE / VulnDb JSON file used by the banner CVE-lookup (Server / X-Powered-By → known CVEs). Null = use the built-in seed set.

public string? CveDbPath { get; init; }

Property Value

string

MinSeverity 

public string? MinSeverity { get; init; }

Property Value

string

Nuclei

Directory of Nuclei-format YAML templates (https://github.com/projectdiscovery/nuclei-templates). Loaded alongside the Bowire-format Templates directory; each Nuclei template gets unfolded into one or more BowireRecordings (multi-path + payload matrices) at load time, with {{BaseURL}} / {{RandStr}} placeholders resolved against Target.

public string? Nuclei { get; init; }

Property Value

string

OastServer

#35 Phase 2f: URL of an interactsh-compatible interaction server for out-of-band detection (e.g. https://oast.example.com). Null = OAST off, which is the default: templates that need a callback are then skipped rather than probed with a placeholder that proves nothing.

This is the only outbound call the scanner makes beyond the target itself, and it only happens because the operator named a server. 

public string? OastServer { get; init; }

Property Value

string

OastToken

#35 Phase 2f: token for a gated interaction server (one started with bowire oast serve --token). Sent verbatim as the Authorization header on the register call. Null = no auth, which matches an open instance.

public string? OastToken { get; init; }

Property Value

string

OastWaitSeconds

#35 Phase 2f: seconds to wait after the probes before polling for callbacks. A target's DNS lookup / fetch lands asynchronously and often a second or two late, so polling immediately would miss it and report the target clean. Default 5.

public int OastWaitSeconds { get; init; }

Property Value

int

OutSarif 

public string? OutSarif { get; init; }

Property Value

string

RunBuiltins 

public bool RunBuiltins { get; init; }

Property Value

bool

Scope

Hostname-glob patterns the scanner is allowed to probe. Each entry is a literal hostname (api.example.com) or a glob with leading (.example.com matches api.example.com and internal.example.com but NOT example.com itself). Empty list = the scope is implicit, derived from the target's own host. Operators who want explicit cross-host scope (e.g. probing redirect-target hosts) widen it via repeated --scope CLI flags.

public IList<string> Scope { get; init; }

Property Value

IList<string>

Suite

Named test-suite to run instead of / alongside the flat template report (case-insensitive). One of:

  • owasp-api — HTTP OWASP probes (when the target is http/https) + the protocol-specific probes, rolled up against the OWASP API Security Top 10 (2023) with a per-entry coverage table (see Kuestenlogik.Bowire.Security.Scanner.OwaspApiSuite).
  • protocol — ONLY the protocol-specific probes (gRPC/GraphQL/WS/MQTT/SSE/MCP) + the table; the HTTP OWASP probes are skipped by design so non-HTTP targets (mqtt://, ws://) are first-class.
  • all — superset alias: everything owasp-api runs.

Null = flat report only.

public string? Suite { get; init; }

Property Value

string

Target 

public string Target { get; init; }

Property Value

string

Template 

public string? Template { get; init; }

Property Value

string

Templates 

public string? Templates { get; init; }

Property Value

string

TimeoutSeconds 

public int TimeoutSeconds { get; init; }

Property Value

int

VulnDbCacheRoot

Override the local template-cache root the scan falls back to when no explicit template source (Template / Templates / Nuclei / Suite) is given. Null → the default ~/.bowire/vulndb the bowire vulndb update command populates. Exposed so embedded hosts (and tests) can pin the cache without depending on the process's home directory. Never fetches — the scan only ever reads this cache.

public string? VulnDbCacheRoot { get; init; }

Property Value

string